<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[202435] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/202435">202435</a></dd>
<dt>Author</dt> <dd>commit-queue@webkit.org</dd>
<dt>Date</dt> <dd>2016-06-24 11:51:07 -0700 (Fri, 24 Jun 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Unreviewed, rolling out <a href="http://trac.webkit.org/projects/webkit/changeset/202413">r202413</a>.
https://bugs.webkit.org/show_bug.cgi?id=159097

Broke many JSC tests (Requested by ap on #webkit).

Reverted changeset:

&quot;[JSC] Implement isFinite / isNaN in JS and make DFG ToNumber
accept non number values&quot;
https://bugs.webkit.org/show_bug.cgi?id=154022
http://trac.webkit.org/changeset/202413</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsmanyforeachcallsjs">trunk/LayoutTests/js/regress/script-tests/many-foreach-calls.js</a></li>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreDerivedSourcesmake">trunk/Source/JavaScriptCore/DerivedSources.make</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCorebuiltinsBuiltinNamesh">trunk/Source/JavaScriptCore/builtins/BuiltinNames.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebuiltinsGlobalObjectjs">trunk/Source/JavaScriptCore/builtins/GlobalObject.js</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeIntrinsicRegistrycpp">trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeIntrinsicRegistryh">trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeListjson">trunk/Source/JavaScriptCore/bytecode/BytecodeList.json</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockcpp">trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp">trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorh">trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerNodesCodegencpp">trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGClobberizeh">trunk/Source/JavaScriptCore/dfg/DFGClobberize.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDoesGCcpp">trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeh">trunk/Source/JavaScriptCore/dfg/DFGNode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeTypeh">trunk/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationscpp">trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationsh">trunk/Source/JavaScriptCore/dfg/DFGOperations.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSafeToExecuteh">trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCapabilitiescpp">trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitAssemblyHelpersh">trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOpcodescpp">trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOpcodes32_64cpp">trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreter32_64asm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreter64asm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm</a></li>
<li><a href="#trunkSourceJavaScriptCoreparserNodesh">trunk/Source/JavaScriptCore/parser/Nodes.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCommonSlowPathscpp">trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionsh">trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMathCommonh">trunk/Source/JavaScriptCore/runtime/MathCommon.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeNumberConstructorcpp">trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeNumberConstructorh">trunk/Source/JavaScriptCore/runtime/NumberConstructor.h</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsregressNumberisNaNexpectedtxt">trunk/LayoutTests/js/regress/Number-isNaN-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressNumberisNaNhtml">trunk/LayoutTests/js/regress/Number-isNaN.html</a></li>
<li><a href="#trunkLayoutTestsjsregressglobalisNaNexpectedtxt">trunk/LayoutTests/js/regress/global-isNaN-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressglobalisNaNhtml">trunk/LayoutTests/js/regress/global-isNaN.html</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsNumberisNaNjs">trunk/LayoutTests/js/regress/script-tests/Number-isNaN.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsglobalisNaNjs">trunk/LayoutTests/js/regress/script-tests/global-isNaN.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscriptteststonumberconstructornumberstringnumberstringjs">trunk/LayoutTests/js/regress/script-tests/to-number-constructor-number-string-number-string.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscriptteststonumberconstructoronlynumberjs">trunk/LayoutTests/js/regress/script-tests/to-number-constructor-only-number.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscriptteststonumberconstructoronlystringjs">trunk/LayoutTests/js/regress/script-tests/to-number-constructor-only-string.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscriptteststonumberconstructorstringnumberstringnumberjs">trunk/LayoutTests/js/regress/script-tests/to-number-constructor-string-number-string-number.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscriptteststonumbernumberstringnumberstringjs">trunk/LayoutTests/js/regress/script-tests/to-number-number-string-number-string.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscriptteststonumberonlynumberjs">trunk/LayoutTests/js/regress/script-tests/to-number-only-number.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscriptteststonumberonlystringjs">trunk/LayoutTests/js/regress/script-tests/to-number-only-string.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscriptteststonumberstringnumberstringnumberjs">trunk/LayoutTests/js/regress/script-tests/to-number-string-number-string-number.js</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumberconstructornumberstringnumberstringexpectedtxt">trunk/LayoutTests/js/regress/to-number-constructor-number-string-number-string-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumberconstructornumberstringnumberstringhtml">trunk/LayoutTests/js/regress/to-number-constructor-number-string-number-string.html</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumberconstructoronlynumberexpectedtxt">trunk/LayoutTests/js/regress/to-number-constructor-only-number-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumberconstructoronlynumberhtml">trunk/LayoutTests/js/regress/to-number-constructor-only-number.html</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumberconstructoronlystringexpectedtxt">trunk/LayoutTests/js/regress/to-number-constructor-only-string-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumberconstructoronlystringhtml">trunk/LayoutTests/js/regress/to-number-constructor-only-string.html</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumberconstructorstringnumberstringnumberexpectedtxt">trunk/LayoutTests/js/regress/to-number-constructor-string-number-string-number-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumberconstructorstringnumberstringnumberhtml">trunk/LayoutTests/js/regress/to-number-constructor-string-number-string-number.html</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumbernumberstringnumberstringexpectedtxt">trunk/LayoutTests/js/regress/to-number-number-string-number-string-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumbernumberstringnumberstringhtml">trunk/LayoutTests/js/regress/to-number-number-string-number-string.html</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumberonlynumberexpectedtxt">trunk/LayoutTests/js/regress/to-number-only-number-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumberonlynumberhtml">trunk/LayoutTests/js/regress/to-number-only-number.html</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumberonlystringexpectedtxt">trunk/LayoutTests/js/regress/to-number-only-string-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumberonlystringhtml">trunk/LayoutTests/js/regress/to-number-only-string.html</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumberstringnumberstringnumberexpectedtxt">trunk/LayoutTests/js/regress/to-number-string-number-string-number-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresstonumberstringnumberstringnumberhtml">trunk/LayoutTests/js/regress/to-number-string-number-string-number.html</a></li>
<li><a href="#trunkSourceJavaScriptCorebuiltinsGlobalOperationsjs">trunk/Source/JavaScriptCore/builtins/GlobalOperations.js</a></li>
<li><a href="#trunkSourceJavaScriptCorebuiltinsNumberConstructorjs">trunk/Source/JavaScriptCore/builtins/NumberConstructor.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressNumberisNaNbasicsjs">trunk/Source/JavaScriptCore/tests/stress/Number-isNaN-basics.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressglobalisfinitejs">trunk/Source/JavaScriptCore/tests/stress/global-is-finite.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressglobalisnanjs">trunk/Source/JavaScriptCore/tests/stress/global-is-nan.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressglobalisNaNbasicsjs">trunk/Source/JavaScriptCore/tests/stress/global-isNaN-basics.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressnumberisfinitejs">trunk/Source/JavaScriptCore/tests/stress/number-is-finite.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressnumberisnanjs">trunk/Source/JavaScriptCore/tests/stress/number-is-nan.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstonumberbasicsjs">trunk/Source/JavaScriptCore/tests/stress/to-number-basics.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstonumberconvertidentitywithoutexecutionjs">trunk/Source/JavaScriptCore/tests/stress/to-number-convert-identity-without-execution.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstonumberint52js">trunk/Source/JavaScriptCore/tests/stress/to-number-int52.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstonumberintrinsicconverttoidentitywithoutexecutionjs">trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-convert-to-identity-without-execution.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstonumberintrinsicint52js">trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-int52.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstonumberintrinsicobjectwithoutexecutionjs">trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-object-without-execution.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstonumberintrinsicvalueprofilingjs">trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-value-profiling.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstonumberobjectwithoutexecutionjs">trunk/Source/JavaScriptCore/tests/stress/to-number-object-without-execution.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstonumberobjectjs">trunk/Source/JavaScriptCore/tests/stress/to-number-object.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstonumbervalueprofilingjs">trunk/Source/JavaScriptCore/tests/stress/to-number-value-profiling.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/ChangeLog        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,3 +1,17 @@
</span><ins>+2016-06-24  Commit Queue  &lt;commit-queue@webkit.org&gt;
+
+        Unreviewed, rolling out r202413.
+        https://bugs.webkit.org/show_bug.cgi?id=159097
+
+        Broke many JSC tests (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        &quot;[JSC] Implement isFinite / isNaN in JS and make DFG ToNumber
+        accept non number values&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=154022
+        http://trac.webkit.org/changeset/202413
+
</ins><span class="cx"> 2016-06-24  John Wilander  &lt;wilander@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Make window.open layout tests for about: URLs work on iOS
</span></span></pre></div>
<a id="trunkLayoutTestsjsregressNumberisNaNexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/Number-isNaN-expected.txt (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/Number-isNaN-expected.txt        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/Number-isNaN-expected.txt        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/Number-isNaN
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressNumberisNaNhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/Number-isNaN.html (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/Number-isNaN.html        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/Number-isNaN.html        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/Number-isNaN.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressglobalisNaNexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/global-isNaN-expected.txt (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/global-isNaN-expected.txt        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/global-isNaN-expected.txt        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/global-isNaN
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressglobalisNaNhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/global-isNaN.html (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/global-isNaN.html        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/global-isNaN.html        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/global-isNaN.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsNumberisNaNjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/Number-isNaN.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/Number-isNaN.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/script-tests/Number-isNaN.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-(function() {
-    var result = 0;
-    var values = [0, -1, 123.45, Infinity, NaN];
-    for (var i = 0; i &lt; 1000000; ++i) {
-        for (var j = 0; j &lt; values.length; ++j) {
-            if (Number.isNaN(values[j]))
-                result++;
-        }
-    }
-    if (result !== 1000000)
-        throw &quot;Error: bad result: &quot; + result;
-})();
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsglobalisNaNjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/global-isNaN.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/global-isNaN.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/script-tests/global-isNaN.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-(function() {
-    var result = 0;
-    var values = [0, -1, 123.45, Infinity, NaN];
-    for (var i = 0; i &lt; 1000000; ++i) {
-        for (var j = 0; j &lt; values.length; ++j) {
-            if (isNaN(values[j]))
-                result++;
-        }
-    }
-    if (result !== 1000000)
-        throw &quot;Error: bad result: &quot; + result;
-})();
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsmanyforeachcallsjs"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/regress/script-tests/many-foreach-calls.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/many-foreach-calls.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/script-tests/many-foreach-calls.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,6 +1,7 @@
</span><del>-for (var i = 0; i &lt; 1e4; ++i) {
-    var sum = 0;
-    [1, 2, 3, 4].forEach(function (value) {
</del><ins>+var sum = 0;
+var array = [1, 2, 3];
+for (var i = 0; i &lt; 1e5; ++i) {
+    array.forEach(function (value) {
</ins><span class="cx">         sum += value;
</span><span class="cx">     });
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkLayoutTestsjsregressscriptteststonumberconstructornumberstringnumberstringjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/to-number-constructor-number-string-number-string.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/to-number-constructor-number-string-number-string.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/script-tests/to-number-constructor-number-string-number-string.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,20 +0,0 @@
</span><del>-function test(value)
-{
-    return Number(value);
-}
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i);
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i.toString());
-
-var result = 0;
-for (var i = 0; i &lt; 4e4; ++i)
-    result = test(i);
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i.toString());
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscriptteststonumberconstructoronlynumberjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/to-number-constructor-only-number.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/to-number-constructor-only-number.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/script-tests/to-number-constructor-only-number.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-function test(value)
-{
-    return Number(value);
-}
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i);
-if (result !== 9999)
-    throw new Error(`bad result ${result}`);
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscriptteststonumberconstructoronlystringjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/to-number-constructor-only-string.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/to-number-constructor-only-string.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/script-tests/to-number-constructor-only-string.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-function test(value)
-{
-    return Number(value);
-}
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i.toString());
-if (result !== 9999)
-    throw new Error(`bad result ${result}`);
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscriptteststonumberconstructorstringnumberstringnumberjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/to-number-constructor-string-number-string-number.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/to-number-constructor-string-number-string-number.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/script-tests/to-number-constructor-string-number-string-number.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,20 +0,0 @@
</span><del>-function test(value)
-{
-    return Number(value);
-}
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i.toString());
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i);
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i.toString());
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i);
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscriptteststonumbernumberstringnumberstringjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/to-number-number-string-number-string.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/to-number-number-string-number-string.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/script-tests/to-number-number-string-number-string.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,20 +0,0 @@
</span><del>-function test(value)
-{
-    return +value;
-}
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i);
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i.toString());
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i);
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i.toString());
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscriptteststonumberonlynumberjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/to-number-only-number.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/to-number-only-number.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/script-tests/to-number-only-number.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-function test(value)
-{
-    return +value;
-}
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i);
-if (result !== 9999)
-    throw new Error(`bad result ${result}`);
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscriptteststonumberonlystringjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/to-number-only-string.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/to-number-only-string.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/script-tests/to-number-only-string.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-function test(value)
-{
-    return +value;
-}
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i.toString());
-if (result !== 9999)
-    throw new Error(`bad result ${result}`);
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscriptteststonumberstringnumberstringnumberjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/to-number-string-number-string-number.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/to-number-string-number-string-number.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/script-tests/to-number-string-number-string-number.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,20 +0,0 @@
</span><del>-function test(value)
-{
-    return +value;
-}
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i.toString());
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i);
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i.toString());
-
-var result = 0;
-for (var i = 0; i &lt; 1e4; ++i)
-    result = test(i);
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumberconstructornumberstringnumberstringexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-constructor-number-string-number-string-expected.txt (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-constructor-number-string-number-string-expected.txt        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-constructor-number-string-number-string-expected.txt        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/to-number-constructor-number-string-number-string
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumberconstructornumberstringnumberstringhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-constructor-number-string-number-string.html (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-constructor-number-string-number-string.html        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-constructor-number-string-number-string.html        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/to-number-constructor-number-string-number-string.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumberconstructoronlynumberexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-constructor-only-number-expected.txt (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-constructor-only-number-expected.txt        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-constructor-only-number-expected.txt        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/to-number-constructor-only-number
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumberconstructoronlynumberhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-constructor-only-number.html (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-constructor-only-number.html        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-constructor-only-number.html        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/to-number-constructor-only-number.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumberconstructoronlystringexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-constructor-only-string-expected.txt (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-constructor-only-string-expected.txt        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-constructor-only-string-expected.txt        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/to-number-constructor-only-string
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumberconstructoronlystringhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-constructor-only-string.html (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-constructor-only-string.html        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-constructor-only-string.html        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/to-number-constructor-only-string.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumberconstructorstringnumberstringnumberexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-constructor-string-number-string-number-expected.txt (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-constructor-string-number-string-number-expected.txt        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-constructor-string-number-string-number-expected.txt        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/to-number-constructor-string-number-string-number
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumberconstructorstringnumberstringnumberhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-constructor-string-number-string-number.html (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-constructor-string-number-string-number.html        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-constructor-string-number-string-number.html        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/to-number-constructor-string-number-string-number.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumbernumberstringnumberstringexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-number-string-number-string-expected.txt (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-number-string-number-string-expected.txt        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-number-string-number-string-expected.txt        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/to-number-number-string-number-string
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumbernumberstringnumberstringhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-number-string-number-string.html (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-number-string-number-string.html        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-number-string-number-string.html        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/to-number-number-string-number-string.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumberonlynumberexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-only-number-expected.txt (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-only-number-expected.txt        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-only-number-expected.txt        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/to-number-only-number
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumberonlynumberhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-only-number.html (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-only-number.html        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-only-number.html        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/to-number-only-number.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumberonlystringexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-only-string-expected.txt (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-only-string-expected.txt        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-only-string-expected.txt        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/to-number-only-string
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumberonlystringhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-only-string.html (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-only-string.html        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-only-string.html        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/to-number-only-string.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumberstringnumberstringnumberexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-string-number-string-number-expected.txt (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-string-number-string-number-expected.txt        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-string-number-string-number-expected.txt        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/to-number-string-number-string-number
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresstonumberstringnumberstringnumberhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/to-number-string-number-string-number.html (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/to-number-string-number-string-number.html        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/LayoutTests/js/regress/to-number-string-number-string-number.html        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/to-number-string-number-string-number.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1217,13 +1217,11 @@
</span><span class="cx">     ${JAVASCRIPTCORE_DIR}/builtins/FunctionPrototype.js
</span><span class="cx">     ${JAVASCRIPTCORE_DIR}/builtins/GeneratorPrototype.js
</span><span class="cx">     ${JAVASCRIPTCORE_DIR}/builtins/GlobalObject.js
</span><del>-    ${JAVASCRIPTCORE_DIR}/builtins/GlobalOperations.js
</del><span class="cx">     ${JAVASCRIPTCORE_DIR}/builtins/InspectorInstrumentationObject.js
</span><span class="cx">     ${JAVASCRIPTCORE_DIR}/builtins/InternalPromiseConstructor.js
</span><span class="cx">     ${JAVASCRIPTCORE_DIR}/builtins/IteratorPrototype.js
</span><span class="cx">     ${JAVASCRIPTCORE_DIR}/builtins/MapPrototype.js
</span><span class="cx">     ${JAVASCRIPTCORE_DIR}/builtins/ModuleLoaderObject.js
</span><del>-    ${JAVASCRIPTCORE_DIR}/builtins/NumberConstructor.js
</del><span class="cx">     ${JAVASCRIPTCORE_DIR}/builtins/NumberPrototype.js
</span><span class="cx">     ${JAVASCRIPTCORE_DIR}/builtins/ObjectConstructor.js
</span><span class="cx">     ${JAVASCRIPTCORE_DIR}/builtins/PromiseConstructor.js
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,3 +1,17 @@
</span><ins>+2016-06-24  Commit Queue  &lt;commit-queue@webkit.org&gt;
+
+        Unreviewed, rolling out r202413.
+        https://bugs.webkit.org/show_bug.cgi?id=159097
+
+        Broke many JSC tests (Requested by ap on #webkit).
+
+        Reverted changeset:
+
+        &quot;[JSC] Implement isFinite / isNaN in JS and make DFG ToNumber
+        accept non number values&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=154022
+        http://trac.webkit.org/changeset/202413
+
</ins><span class="cx"> 2016-06-23  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         OOM Assertion failure in Array.prototype.toString
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreDerivedSourcesmake"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/DerivedSources.make (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/DerivedSources.make        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/DerivedSources.make        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -88,13 +88,11 @@
</span><span class="cx">     $(JavaScriptCore)/builtins/FunctionPrototype.js \
</span><span class="cx">     $(JavaScriptCore)/builtins/GeneratorPrototype.js \
</span><span class="cx">     $(JavaScriptCore)/builtins/GlobalObject.js \
</span><del>-    $(JavaScriptCore)/builtins/GlobalOperations.js \
</del><span class="cx">     $(JavaScriptCore)/builtins/InspectorInstrumentationObject.js \
</span><span class="cx">     $(JavaScriptCore)/builtins/InternalPromiseConstructor.js \
</span><span class="cx">     $(JavaScriptCore)/builtins/IteratorPrototype.js \
</span><span class="cx">     $(JavaScriptCore)/builtins/MapPrototype.js \
</span><span class="cx">     $(JavaScriptCore)/builtins/ModuleLoaderObject.js \
</span><del>-    $(JavaScriptCore)/builtins/NumberConstructor.js \
</del><span class="cx">     $(JavaScriptCore)/builtins/NumberPrototype.js \
</span><span class="cx">     $(JavaScriptCore)/builtins/ObjectConstructor.js \
</span><span class="cx">     $(JavaScriptCore)/builtins/PromiseConstructor.js \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -3772,8 +3772,6 @@
</span><span class="cx">                 A513E5C9185F9624007E95AD /* InjectedScriptManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptManager.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A514B2C0185A684400F3C7CB /* InjectedScriptBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScriptBase.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A514B2C1185A684400F3C7CB /* InjectedScriptBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptBase.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><del>-                A52704851D027C8800354C37 /* GlobalOperations.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = GlobalOperations.js; sourceTree = &quot;&lt;group&gt;&quot;; };
-                A52704861D027C8800354C37 /* NumberConstructor.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = NumberConstructor.js; sourceTree = &quot;&lt;group&gt;&quot;; };
</del><span class="cx">                 A5311C341C77CEAC00E6B1B6 /* HeapSnapshotBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HeapSnapshotBuilder.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A5311C351C77CEAC00E6B1B6 /* HeapSnapshotBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapSnapshotBuilder.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A532438118568317002ED692 /* InspectorBackendDispatchers.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorBackendDispatchers.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -6885,13 +6883,11 @@
</span><span class="cx">                                 A7A979C418BE8D9E002C3733 /* FunctionPrototype.js */,
</span><span class="cx">                                 70B7918F1C0244EC002481E2 /* GeneratorPrototype.js */,
</span><span class="cx">                                 7CF9BC5A1B65D9A3009DB1EF /* GlobalObject.js */,
</span><del>-                                A52704851D027C8800354C37 /* GlobalOperations.js */,
</del><span class="cx">                                 E35E03611B7AB4850073AD2A /* InspectorInstrumentationObject.js */,
</span><span class="cx">                                 E33F50881B844A1A00413856 /* InternalPromiseConstructor.js */,
</span><span class="cx">                                 7CF9BC5B1B65D9A3009DB1EF /* IteratorPrototype.js */,
</span><span class="cx">                                 7035587C1C418419004BD7BF /* MapPrototype.js */,
</span><span class="cx">                                 E30677971B8BC6F5003F87F0 /* ModuleLoaderObject.js */,
</span><del>-                                A52704861D027C8800354C37 /* NumberConstructor.js */,
</del><span class="cx">                                 A15DE5C51C0FBF8D0089133D /* NumberPrototype.js */,
</span><span class="cx">                                 7CF9BC5C1B65D9B1009DB1EF /* ObjectConstructor.js */,
</span><span class="cx">                                 7CF9BC5D1B65D9B1009DB1EF /* PromiseOperations.js */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsBuiltinNamesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/builtins/BuiltinNames.h (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/BuiltinNames.h        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/builtins/BuiltinNames.h        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -64,6 +64,8 @@
</span><span class="cx">     macro(abs) \
</span><span class="cx">     macro(floor) \
</span><span class="cx">     macro(trunc) \
</span><ins>+    macro(isFinite) \
+    macro(isNaN) \
</ins><span class="cx">     macro(create) \
</span><span class="cx">     macro(defineProperty) \
</span><span class="cx">     macro(getPrototypeOf) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsGlobalObjectjs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/builtins/GlobalObject.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/GlobalObject.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/builtins/GlobalObject.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015-2016 Yusuke Suzuki &lt;utatane.tea@gmail.com&gt;.
</del><ins>+ * Copyright (C) 2015 Yusuke Suzuki &lt;utatane.tea@gmail.com&gt;.
</ins><span class="cx">  * Copyright (C) 2016 Apple Inc. All rights reserved.
</span><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -24,23 +24,60 @@
</span><span class="cx">  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
</span><span class="cx">  */
</span><span class="cx"> 
</span><ins>+// @internal
+
</ins><span class="cx"> @globalPrivate
</span><del>-function isFinite(value)
</del><ins>+function toInteger(target)
</ins><span class="cx"> {
</span><span class="cx">     &quot;use strict&quot;;
</span><span class="cx"> 
</span><del>-    var numberValue = @toNumber(value);
-    // Return false if numberValue is |NaN|.
</del><ins>+    var numberValue = @Number(target);
+
+    // isNaN(numberValue)
</ins><span class="cx">     if (numberValue !== numberValue)
</span><del>-        return false;
-    return numberValue !== @Infinity &amp;&amp; numberValue !== -@Infinity;
</del><ins>+        return 0;
+    return @trunc(numberValue);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> @globalPrivate
</span><del>-function isNaN(value)
</del><ins>+function toLength(target)
</ins><span class="cx"> {
</span><span class="cx">     &quot;use strict&quot;;
</span><span class="cx"> 
</span><del>-    var numberValue = @toNumber(value);
-    return numberValue !== numberValue;
</del><ins>+    var maxSafeInteger = 0x1FFFFFFFFFFFFF;
+    var length = @toInteger(target);
+    // originally Math.min(Math.max(length, 0), maxSafeInteger));
+    return length &gt; 0 ? (length &lt; maxSafeInteger ? length : maxSafeInteger) : 0;
</ins><span class="cx"> }
</span><ins>+
+@globalPrivate
+function isDictionary(object)
+{
+    &quot;use strict&quot;;
+
+    return object === @undefined || object == null || typeof object === &quot;object&quot;;
+}
+
+// FIXME: this needs to have it's name changed to &quot;get [Symbol.species]&quot;.
+// see: https://bugs.webkit.org/show_bug.cgi?id=151363
+@globalPrivate
+function speciesGetter()
+{
+    return this;
+}
+
+@globalPrivate
+function speciesConstructor(obj, defaultConstructor)
+{
+    var constructor = obj.constructor;
+    if (constructor === @undefined)
+        return defaultConstructor;
+    if (!@isObject(constructor))
+        throw new @TypeError(&quot;|this|.constructor is not an Object or undefined&quot;);
+    constructor = constructor.@speciesSymbol;
+    if (constructor == null)
+        return defaultConstructor;
+    if (@isConstructor(constructor))
+        return constructor;
+    throw new @TypeError(&quot;|this|.constructor[Symbol.species] is not a constructor&quot;);
+}
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsGlobalOperationsjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/builtins/GlobalOperations.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/GlobalOperations.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/builtins/GlobalOperations.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,82 +0,0 @@
</span><del>-/*
- * Copyright (C) 2016 Yusuke Suzuki &lt;utatane.tea@gmail.com&gt;.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-// @internal
-
-@globalPrivate
-function toInteger(target)
-{
-    &quot;use strict&quot;;
-
-    var numberValue = @Number(target);
-
-    // isNaN(numberValue)
-    if (numberValue !== numberValue)
-        return 0;
-    return @trunc(numberValue);
-}
-
-@globalPrivate
-function toLength(target)
-{
-    &quot;use strict&quot;;
-
-    var length = @toInteger(target);
-    // originally Math.min(Math.max(length, 0), maxSafeInteger));
-    return length &gt; 0 ? (length &lt; @MAX_SAFE_INTEGER? length : @MAX_SAFE_INTEGER) : 0;
-
-}
-
-@globalPrivate
-function isDictionary(object)
-{
-    &quot;use strict&quot;;
-
-    return object === @undefined || object == null || typeof object === &quot;object&quot;;
-}
-
-// FIXME: this needs to have it's name changed to &quot;get [Symbol.species]&quot;.
-// see: https://bugs.webkit.org/show_bug.cgi?id=151363
-@globalPrivate
-function speciesGetter()
-{
-    return this;
-}
-
-@globalPrivate
-function speciesConstructor(obj, defaultConstructor)
-{
-    var constructor = obj.constructor;
-    if (constructor === @undefined)
-        return defaultConstructor;
-    if (!@isObject(constructor))
-        throw new @TypeError(&quot;|this|.constructor is not an Object or undefined&quot;);
-    constructor = constructor.@speciesSymbol;
-    if (constructor == null)
-        return defaultConstructor;
-    if (@isConstructor(constructor))
-        return constructor;
-    throw new @TypeError(&quot;|this|.constructor[Symbol.species] is not a constructor&quot;);
-}
</del></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsNumberConstructorjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/builtins/NumberConstructor.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/NumberConstructor.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/builtins/NumberConstructor.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,45 +0,0 @@
</span><del>-/*
- * Copyright (C) 2016 Yusuke Suzuki &lt;utatane.tea@gmail.com&gt;.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-function isFinite(value)
-{
-    &quot;use strict&quot;;
-
-    if (typeof value !== &quot;number&quot;)
-        return false;
-
-    // Return false if value is |NaN|.
-    if (value !== value)
-        return false;
-
-    return value !== @Infinity &amp;&amp; value !== -@Infinity;
-}
-
-function isNaN(value)
-{
-    &quot;use strict&quot;;
-
-    return value !== value;
-}
</del></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeIntrinsicRegistrycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -54,7 +54,7 @@
</span><span class="cx">     m_arrayIterationKindValue.set(m_vm, jsNumber(ArrayIterateValue));
</span><span class="cx">     m_arrayIterationKindKeyValue.set(m_vm, jsNumber(ArrayIterateKeyValue));
</span><span class="cx">     m_MAX_STRING_LENGTH.set(m_vm, jsNumber(JSString::MaxLength));
</span><del>-    m_MAX_SAFE_INTEGER.set(m_vm, jsDoubleNumber(maxSafeInteger()));
</del><ins>+    m_MAX_SAFE_INTEGER.set(m_vm, jsDoubleNumber(9007199254740991.0)); // 2 ^ 53 - 1
</ins><span class="cx">     m_ModuleFetch.set(m_vm, jsNumber(static_cast&lt;unsigned&gt;(ModuleLoaderObject::Status::Fetch)));
</span><span class="cx">     m_ModuleTranslate.set(m_vm, jsNumber(static_cast&lt;unsigned&gt;(ModuleLoaderObject::Status::Translate)));
</span><span class="cx">     m_ModuleInstantiate.set(m_vm, jsNumber(static_cast&lt;unsigned&gt;(ModuleLoaderObject::Status::Instantiate)));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeIntrinsicRegistryh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -47,7 +47,6 @@
</span><span class="cx">     macro(tailCallForwardArguments) \
</span><span class="cx">     macro(tryGetById) \
</span><span class="cx">     macro(putByValDirect) \
</span><del>-    macro(toNumber) \
</del><span class="cx">     macro(toString)
</span><span class="cx"> 
</span><span class="cx"> #define JSC_COMMON_BYTECODE_INTRINSIC_CONSTANTS_EACH_NAME(macro) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeListjson"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeList.json (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeList.json        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeList.json        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -31,7 +31,7 @@
</span><span class="cx">             { &quot;name&quot; : &quot;op_greatereq&quot;, &quot;length&quot; : 4 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_inc&quot;, &quot;length&quot; : 2 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_dec&quot;, &quot;length&quot; : 2 },
</span><del>-            { &quot;name&quot; : &quot;op_to_number&quot;, &quot;length&quot; : 4 },
</del><ins>+            { &quot;name&quot; : &quot;op_to_number&quot;, &quot;length&quot; : 3 },
</ins><span class="cx">             { &quot;name&quot; : &quot;op_to_string&quot;, &quot;length&quot; : 3 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_negate&quot;, &quot;length&quot; : 3 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_add&quot;, &quot;length&quot; : 5 },
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -992,7 +992,6 @@
</span><span class="cx">         }
</span><span class="cx">         case op_to_number: {
</span><span class="cx">             printUnaryOp(out, exec, location, it, &quot;to_number&quot;);
</span><del>-            dumpValueProfiling(out, it, hasPrintedProfiling);
</del><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case op_to_string: {
</span><span class="lines">@@ -2094,8 +2093,7 @@
</span><span class="cx">         }
</span><span class="cx">         case op_get_direct_pname:
</span><span class="cx">         case op_get_by_id:
</span><del>-        case op_get_from_arguments:
-        case op_to_number: {
</del><ins>+        case op_get_from_arguments: {
</ins><span class="cx">             ValueProfile* profile = &amp;m_valueProfiles[pc[opLength - 1].u.operand];
</span><span class="cx">             ASSERT(profile-&gt;m_bytecodeOffset == -1);
</span><span class="cx">             profile-&gt;m_bytecodeOffset = i;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1525,7 +1525,6 @@
</span><span class="cx"> 
</span><span class="cx"> RegisterID* BytecodeGenerator::emitUnaryOp(OpcodeID opcodeID, RegisterID* dst, RegisterID* src)
</span><span class="cx"> {
</span><del>-    ASSERT_WITH_MESSAGE(op_to_number != opcodeID, &quot;op_to_number is profiled.&quot;);
</del><span class="cx">     emitOpcode(opcodeID);
</span><span class="cx">     instructions().append(dst-&gt;index());
</span><span class="cx">     instructions().append(src-&gt;index());
</span><span class="lines">@@ -1532,15 +1531,6 @@
</span><span class="cx">     return dst;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RegisterID* BytecodeGenerator::emitUnaryOpProfiled(OpcodeID opcodeID, RegisterID* dst, RegisterID* src)
-{
-    UnlinkedValueProfile profile = emitProfiledOpcode(opcodeID);
-    instructions().append(dst-&gt;index());
-    instructions().append(src-&gt;index());
-    instructions().append(profile);
-    return dst;
-}
-
</del><span class="cx"> RegisterID* BytecodeGenerator::emitInc(RegisterID* srcDst)
</span><span class="cx"> {
</span><span class="cx">     emitOpcode(op_inc);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -510,7 +510,6 @@
</span><span class="cx">         RegisterID* emitLoadGlobalObject(RegisterID* dst);
</span><span class="cx"> 
</span><span class="cx">         RegisterID* emitUnaryOp(OpcodeID, RegisterID* dst, RegisterID* src);
</span><del>-        RegisterID* emitUnaryOpProfiled(OpcodeID, RegisterID* dst, RegisterID* src);
</del><span class="cx">         RegisterID* emitBinaryOp(OpcodeID, RegisterID* dst, RegisterID* src1, RegisterID* src2, OperandTypes);
</span><span class="cx">         RegisterID* emitEqualityOp(OpcodeID, RegisterID* dst, RegisterID* src1, RegisterID* src2);
</span><span class="cx">         RegisterID* emitUnaryNoDstOp(OpcodeID, RegisterID* src);
</span><span class="lines">@@ -537,7 +536,7 @@
</span><span class="cx">         RegisterID* emitMoveEmptyValue(RegisterID* dst);
</span><span class="cx">         RegisterID* emitMove(RegisterID* dst, RegisterID* src);
</span><span class="cx"> 
</span><del>-        RegisterID* emitToNumber(RegisterID* dst, RegisterID* src) { return emitUnaryOpProfiled(op_to_number, dst, src); }
</del><ins>+        RegisterID* emitToNumber(RegisterID* dst, RegisterID* src) { return emitUnaryOp(op_to_number, dst, src); }
</ins><span class="cx">         RegisterID* emitToString(RegisterID* dst, RegisterID* src) { return emitUnaryOp(op_to_string, dst, src); }
</span><span class="cx">         RegisterID* emitInc(RegisterID* srcDst);
</span><span class="cx">         RegisterID* emitDec(RegisterID* srcDst);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerNodesCodegencpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -918,15 +918,6 @@
</span><span class="cx">     return generator.emitTryGetById(finalDest.get(), base.get(), ident);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-RegisterID* BytecodeIntrinsicNode::emit_intrinsic_toNumber(BytecodeGenerator&amp; generator, RegisterID* dst)
-{
-    ArgumentListNode* node = m_args-&gt;m_listNode;
-    RefPtr&lt;RegisterID&gt; src = generator.emitNode(node);
-    ASSERT(!node-&gt;m_next);
-
-    return generator.moveToDestinationIfNeeded(dst, generator.emitToNumber(generator.tempDestination(dst), src.get()));
-}
-
</del><span class="cx"> RegisterID* BytecodeIntrinsicNode::emit_intrinsic_toString(BytecodeGenerator&amp; generator, RegisterID* dst)
</span><span class="cx"> {
</span><span class="cx">     ArgumentListNode* node = m_args-&gt;m_listNode;
</span><span class="lines">@@ -1558,16 +1549,6 @@
</span><span class="cx">     return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src.get());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-// ------------------------------ UnaryPlusNode -----------------------------------
-
-RegisterID* UnaryPlusNode::emitBytecode(BytecodeGenerator&amp; generator, RegisterID* dst)
-{
-    ASSERT(opcodeID() == op_to_number);
-    RefPtr&lt;RegisterID&gt; src = generator.emitNode(expr());
-    generator.emitExpressionInfo(position(), position(), position());
-    return generator.emitToNumber(generator.finalDestination(dst), src.get());
-}
-
</del><span class="cx"> // ------------------------------ BitwiseNotNode -----------------------------------
</span><span class="cx">  
</span><span class="cx"> RegisterID* BitwiseNotNode::emitBytecode(BytecodeGenerator&amp; generator, RegisterID* dst)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1827,6 +1827,11 @@
</span><span class="cx">         
</span><span class="cx">         ASSERT(node-&gt;child1().useKind() == UntypedUse);
</span><span class="cx">         
</span><ins>+        if (!forNode(node-&gt;child1()).m_type) {
+            m_state.setIsValid(false);
+            break;
+        }
+        
</ins><span class="cx">         if (!(forNode(node-&gt;child1()).m_type &amp; ~(SpecFullNumber | SpecBoolean | SpecString | SpecSymbol))) {
</span><span class="cx">             m_state.setFoundConstants(true);
</span><span class="cx">             forNode(node) = forNode(node-&gt;child1());
</span><span class="lines">@@ -1838,26 +1843,6 @@
</span><span class="cx">         forNode(node).setType(m_graph, SpecHeapTop &amp; ~SpecObject);
</span><span class="cx">         break;
</span><span class="cx">     }
</span><del>-
-    case ToNumber: {
-        JSValue childConst = forNode(node-&gt;child1()).value();
-        if (childConst &amp;&amp; childConst.isNumber()) {
-            setConstant(node, childConst);
-            break;
-        }
-
-        ASSERT(node-&gt;child1().useKind() == UntypedUse);
-
-        if (!(forNode(node-&gt;child1()).m_type &amp; ~SpecBytecodeNumber)) {
-            m_state.setFoundConstants(true);
-            forNode(node) = forNode(node-&gt;child1());
-            break;
-        }
-
-        clobberWorld(node-&gt;origin.semantic, clobberLimit);
-        forNode(node).setType(m_graph, SpecBytecodeNumber);
-        break;
-    }
</del><span class="cx">         
</span><span class="cx">     case ToString:
</span><span class="cx">     case CallStringConstructor: {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -42,10 +42,9 @@
</span><span class="cx"> #include &quot;DFGJITCode.h&quot;
</span><span class="cx"> #include &quot;GetByIdStatus.h&quot;
</span><span class="cx"> #include &quot;Heap.h&quot;
</span><ins>+#include &quot;JSLexicalEnvironment.h&quot;
</ins><span class="cx"> #include &quot;JSCInlines.h&quot;
</span><del>-#include &quot;JSLexicalEnvironment.h&quot;
</del><span class="cx"> #include &quot;JSModuleEnvironment.h&quot;
</span><del>-#include &quot;NumberConstructor.h&quot;
</del><span class="cx"> #include &quot;ObjectConstructor.h&quot;
</span><span class="cx"> #include &quot;PreciseJumpTargets.h&quot;
</span><span class="cx"> #include &quot;PutByIdFlags.h&quot;
</span><span class="lines">@@ -216,7 +215,7 @@
</span><span class="cx">     template&lt;typename ChecksFunctor&gt;
</span><span class="cx">     bool handleTypedArrayConstructor(int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, TypedArrayType, const ChecksFunctor&amp; insertChecks);
</span><span class="cx">     template&lt;typename ChecksFunctor&gt;
</span><del>-    bool handleConstantInternalFunction(Node* callTargetNode, int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, CodeSpecializationKind, SpeculatedType, const ChecksFunctor&amp; insertChecks);
</del><ins>+    bool handleConstantInternalFunction(Node* callTargetNode, int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, CodeSpecializationKind, const ChecksFunctor&amp; insertChecks);
</ins><span class="cx">     Node* handlePutByOffset(Node* base, unsigned identifier, PropertyOffset, const InferredType::Descriptor&amp;, Node* value);
</span><span class="cx">     Node* handleGetByOffset(SpeculatedType, Node* base, unsigned identifierNumber, PropertyOffset, const InferredType::Descriptor&amp;, NodeType = GetByOffset);
</span><span class="cx"> 
</span><span class="lines">@@ -1652,7 +1651,7 @@
</span><span class="cx">         };
</span><span class="cx">     
</span><span class="cx">         if (InternalFunction* function = callee.internalFunction()) {
</span><del>-            if (handleConstantInternalFunction(callTargetNode, resultOperand, function, registerOffset, argumentCountIncludingThis, specializationKind, prediction, insertChecksWithAccounting)) {
</del><ins>+            if (handleConstantInternalFunction(callTargetNode, resultOperand, function, registerOffset, argumentCountIncludingThis, specializationKind, insertChecksWithAccounting)) {
</ins><span class="cx">                 RELEASE_ASSERT(didInsertChecks);
</span><span class="cx">                 addToGraph(Phantom, callTargetNode);
</span><span class="cx">                 emitArgumentPhantoms(registerOffset, argumentCountIncludingThis);
</span><span class="lines">@@ -2638,7 +2637,7 @@
</span><span class="cx"> template&lt;typename ChecksFunctor&gt;
</span><span class="cx"> bool ByteCodeParser::handleConstantInternalFunction(
</span><span class="cx">     Node* callTargetNode, int resultOperand, InternalFunction* function, int registerOffset,
</span><del>-    int argumentCountIncludingThis, CodeSpecializationKind kind, SpeculatedType prediction, const ChecksFunctor&amp; insertChecks)
</del><ins>+    int argumentCountIncludingThis, CodeSpecializationKind kind, const ChecksFunctor&amp; insertChecks)
</ins><span class="cx"> {
</span><span class="cx">     if (verbose)
</span><span class="cx">         dataLog(&quot;    Handling constant internal function &quot;, JSValue(function), &quot;\n&quot;);
</span><span class="lines">@@ -2669,19 +2668,6 @@
</span><span class="cx">             addToGraph(Node::VarArg, NewArray, OpInfo(ArrayWithUndecided), OpInfo(0)));
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><del>-
-    if (function-&gt;classInfo() == NumberConstructor::info()) {
-        if (kind == CodeForConstruct)
-            return false;
-
-        insertChecks();
-        if (argumentCountIncludingThis &lt;= 1)
-            set(VirtualRegister(resultOperand), jsConstant(jsNumber(0)));
-        else
-            set(VirtualRegister(resultOperand), addToGraph(ToNumber, OpInfo(0), OpInfo(prediction), get(virtualRegisterForArgument(1, registerOffset))));
-
-        return true;
-    }
</del><span class="cx">     
</span><span class="cx">     if (function-&gt;classInfo() == StringConstructor::info()) {
</span><span class="cx">         insertChecks();
</span><span class="lines">@@ -5060,9 +5046,9 @@
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         case op_to_number: {
</span><del>-            SpeculatedType prediction = getPrediction();
-            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
-            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(ToNumber, OpInfo(0), OpInfo(prediction), value));
</del><ins>+            Node* node = get(VirtualRegister(currentInstruction[2].u.operand));
+            addToGraph(Phantom, Edge(node, NumberUse));
+            set(VirtualRegister(currentInstruction[1].u.operand), node);
</ins><span class="cx">             NEXT_OPCODE(op_to_number);
</span><span class="cx">         }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGClobberizeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGClobberize.h (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGClobberize.h        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/dfg/DFGClobberize.h        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1173,12 +1173,6 @@
</span><span class="cx">         read(World);
</span><span class="cx">         write(Heap);
</span><span class="cx">         return;
</span><del>-
-    case ToNumber: {
-        read(World);
-        write(Heap);
-        return;
-    }
</del><span class="cx">         
</span><span class="cx">     case ToString:
</span><span class="cx">     case CallStringConstructor:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -566,15 +566,6 @@
</span><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx"> 
</span><del>-            case ToNumber: {
-                if (m_state.forNode(node-&gt;child1()).m_type &amp; ~SpecBytecodeNumber)
-                    break;
-
-                node-&gt;convertToIdentity();
-                changed = true;
-                break;
-            }
-
</del><span class="cx">             case Check: {
</span><span class="cx">                 alreadyHandled = true;
</span><span class="cx">                 m_interpreter.execute(indexInBlock);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDoesGCcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -169,7 +169,6 @@
</span><span class="cx">     case TypeOf:
</span><span class="cx">     case LogicalNot:
</span><span class="cx">     case ToPrimitive:
</span><del>-    case ToNumber:
</del><span class="cx">     case ToString:
</span><span class="cx">     case CallStringConstructor:
</span><span class="cx">     case In:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -989,11 +989,6 @@
</span><span class="cx">             fixupToPrimitive(node);
</span><span class="cx">             break;
</span><span class="cx">         }
</span><del>-
-        case ToNumber: {
-            fixupToNumber(node);
-            break;
-        }
</del><span class="cx">             
</span><span class="cx">         case ToString:
</span><span class="cx">         case CallStringConstructor: {
</span><span class="lines">@@ -1803,32 +1798,6 @@
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">     }
</span><del>-
-    void fixupToNumber(Node* node)
-    {
-        if (node-&gt;child1()-&gt;shouldSpeculateInt32()) {
-            fixEdge&lt;Int32Use&gt;(node-&gt;child1());
-            node-&gt;convertToIdentity();
-            return;
-        }
-
-        if (enableInt52() &amp;&amp; node-&gt;child1()-&gt;shouldSpeculateAnyInt()) {
-            fixEdge&lt;Int52RepUse&gt;(node-&gt;child1());
-            node-&gt;convertToIdentity();
-            node-&gt;setResult(NodeResultInt52);
-            return;
-        }
-
-        if (node-&gt;child1()-&gt;shouldSpeculateNumber()) {
-            fixEdge&lt;DoubleRepUse&gt;(node-&gt;child1());
-            node-&gt;convertToIdentity();
-            node-&gt;setResult(NodeResultDouble);
-            return;
-        }
-
-        fixEdge&lt;UntypedUse&gt;(node-&gt;child1());
-        node-&gt;setResult(NodeResultJS);
-    }
</del><span class="cx">     
</span><span class="cx">     void fixupToStringOrCallStringConstructor(Node* node)
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.h (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.h        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.h        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1439,7 +1439,6 @@
</span><span class="cx">         case GetGlobalLexicalVariable:
</span><span class="cx">         case StringReplace:
</span><span class="cx">         case StringReplaceRegExp:
</span><del>-        case ToNumber:
</del><span class="cx">             return true;
</span><span class="cx">         default:
</span><span class="cx">             return false;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeType.h (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeType.h        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeType.h        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -322,7 +322,6 @@
</span><span class="cx">     macro(LogicalNot, NodeResultBoolean) \
</span><span class="cx">     macro(ToPrimitive, NodeResultJS | NodeMustGenerate) \
</span><span class="cx">     macro(ToString, NodeResultJS | NodeMustGenerate) \
</span><del>-    macro(ToNumber, NodeResultJS | NodeMustGenerate) \
</del><span class="cx">     macro(CallObjectConstructor, NodeResultJS) \
</span><span class="cx">     macro(CallStringConstructor, NodeResultJS | NodeMustGenerate) \
</span><span class="cx">     macro(NewStringObject, NodeResultJS) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -731,14 +731,6 @@
</span><span class="cx">     return JSValue::encode(JSValue::decode(value).toPrimitive(exec));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-EncodedJSValue JIT_OPERATION operationToNumber(ExecState* exec, EncodedJSValue value)
-{
-    VM* vm = &amp;exec-&gt;vm();
-    NativeCallFrameTracer tracer(vm, exec);
-
-    return JSValue::encode(jsNumber(JSValue::decode(value).toNumber(exec)));
-}
-
</del><span class="cx"> EncodedJSValue JIT_OPERATION operationGetByIdWithThis(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedThis, UniquedStringImpl* impl)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOperationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.h (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.h        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.h        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -58,7 +58,6 @@
</span><span class="cx"> EncodedJSValue JIT_OPERATION operationGetByValArrayInt(ExecState*, JSArray*, int32_t) WTF_INTERNAL;
</span><span class="cx"> EncodedJSValue JIT_OPERATION operationGetByValStringInt(ExecState*, JSString*, int32_t) WTF_INTERNAL;
</span><span class="cx"> EncodedJSValue JIT_OPERATION operationToPrimitive(ExecState*, EncodedJSValue) WTF_INTERNAL;
</span><del>-EncodedJSValue JIT_OPERATION operationToNumber(ExecState*, EncodedJSValue) WTF_INTERNAL;
</del><span class="cx"> EncodedJSValue JIT_OPERATION operationGetByIdWithThis(ExecState*, EncodedJSValue, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
</span><span class="cx"> EncodedJSValue JIT_OPERATION operationGetByValWithThis(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue) WTF_INTERNAL;
</span><span class="cx"> char* JIT_OPERATION operationNewArray(ExecState*, Structure*, void*, size_t) WTF_INTERNAL;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -712,8 +712,7 @@
</span><span class="cx">         case GetGlobalVar:
</span><span class="cx">         case GetGlobalLexicalVariable:
</span><span class="cx">         case GetClosureVar:
</span><del>-        case GetFromArguments:
-        case ToNumber: {
</del><ins>+        case GetFromArguments: {
</ins><span class="cx">             setPrediction(m_currentNode-&gt;getHeapPrediction());
</span><span class="cx">             break;
</span><span class="cx">         }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSafeToExecuteh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -272,7 +272,6 @@
</span><span class="cx">     case CallObjectConstructor:
</span><span class="cx">     case ToPrimitive:
</span><span class="cx">     case ToString:
</span><del>-    case ToNumber:
</del><span class="cx">     case SetFunctionName:
</span><span class="cx">     case StrCat:
</span><span class="cx">     case CallStringConstructor:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -3567,73 +3567,32 @@
</span><span class="cx">         
</span><span class="cx">     case ToPrimitive: {
</span><span class="cx">         RELEASE_ASSERT(node-&gt;child1().useKind() == UntypedUse);
</span><del>-        JSValueOperand argument(this, node-&gt;child1());
-        GPRTemporary resultTag(this, Reuse, argument, TagWord);
-        GPRTemporary resultPayload(this, Reuse, argument, PayloadWord);
</del><ins>+        JSValueOperand op1(this, node-&gt;child1());
+        GPRTemporary resultTag(this, Reuse, op1, TagWord);
+        GPRTemporary resultPayload(this, Reuse, op1, PayloadWord);
</ins><span class="cx">         
</span><del>-        GPRReg argumentTagGPR = argument.tagGPR();
-        GPRReg argumentPayloadGPR = argument.payloadGPR();
</del><ins>+        GPRReg op1TagGPR = op1.tagGPR();
+        GPRReg op1PayloadGPR = op1.payloadGPR();
</ins><span class="cx">         GPRReg resultTagGPR = resultTag.gpr();
</span><span class="cx">         GPRReg resultPayloadGPR = resultPayload.gpr();
</span><span class="cx">         
</span><del>-        argument.use();
</del><ins>+        op1.use();
</ins><span class="cx">         
</span><del>-        MacroAssembler::Jump alreadyPrimitive = m_jit.branchIfNotCell(argument.jsValueRegs());
-        MacroAssembler::Jump notPrimitive = m_jit.branchIfObject(argumentPayloadGPR);
</del><ins>+        MacroAssembler::Jump alreadyPrimitive = m_jit.branchIfNotCell(op1.jsValueRegs());
+        MacroAssembler::Jump notPrimitive = m_jit.branchIfObject(op1PayloadGPR);
</ins><span class="cx">         
</span><span class="cx">         alreadyPrimitive.link(&amp;m_jit);
</span><del>-        m_jit.move(argumentTagGPR, resultTagGPR);
-        m_jit.move(argumentPayloadGPR, resultPayloadGPR);
</del><ins>+        m_jit.move(op1TagGPR, resultTagGPR);
+        m_jit.move(op1PayloadGPR, resultPayloadGPR);
</ins><span class="cx">         
</span><span class="cx">         addSlowPathGenerator(
</span><span class="cx">             slowPathCall(
</span><span class="cx">                 notPrimitive, this, operationToPrimitive,
</span><del>-                JSValueRegs(resultTagGPR, resultPayloadGPR), argumentTagGPR, argumentPayloadGPR));
</del><ins>+                JSValueRegs(resultTagGPR, resultPayloadGPR), op1TagGPR, op1PayloadGPR));
</ins><span class="cx">         
</span><span class="cx">         jsValueResult(resultTagGPR, resultPayloadGPR, node, UseChildrenCalledExplicitly);
</span><span class="cx">         break;
</span><span class="cx">     }
</span><del>-
-    case ToNumber: {
-        JSValueOperand argument(this, node-&gt;child1());
-        GPRTemporary resultTag(this, Reuse, argument, TagWord);
-        GPRTemporary resultPayload(this, Reuse, argument, PayloadWord);
-
-        GPRReg argumentPayloadGPR = argument.payloadGPR();
-        GPRReg argumentTagGPR = argument.tagGPR();
-        JSValueRegs resultRegs(resultTag.gpr(), resultPayload.gpr());
-
-        argument.use();
-
-        // We have several attempts to remove ToNumber. But ToNumber still exists.
-        // It means that converting non-numbers to numbers by this ToNumber is not rare.
-        // Instead of the slow path generator, we emit callOperation here.
-        if (!(m_state.forNode(node-&gt;child1()).m_type &amp; SpecBytecodeNumber)) {
-            flushRegisters();
-            callOperation(operationToNumber, resultRegs, argumentTagGPR, argumentPayloadGPR);
-            m_jit.exceptionCheck();
-        } else {
-            MacroAssembler::Jump notNumber;
-            {
-                GPRTemporary scratch(this);
-                notNumber = m_jit.branchIfNotNumber(argument.jsValueRegs(), scratch.gpr());
-            }
-            m_jit.move(argumentTagGPR, resultRegs.tagGPR());
-            m_jit.move(argumentPayloadGPR, resultRegs.payloadGPR());
-            MacroAssembler::Jump done = m_jit.jump();
-
-            notNumber.link(&amp;m_jit);
-            silentSpillAllRegisters(resultRegs);
-            callOperation(operationToNumber, resultRegs, argumentTagGPR, argumentPayloadGPR);
-            silentFillAllRegisters(resultRegs);
-            m_jit.exceptionCheck();
-
-            done.link(&amp;m_jit);
-        }
-
-        jsValueResult(resultRegs.tagGPR(), resultRegs.payloadGPR(), node, UseChildrenCalledExplicitly);
-        break;
-    }
</del><span class="cx">         
</span><span class="cx">     case ToString:
</span><span class="cx">     case CallStringConstructor: {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -3520,60 +3520,26 @@
</span><span class="cx">         
</span><span class="cx">     case ToPrimitive: {
</span><span class="cx">         DFG_ASSERT(m_jit.graph(), node, node-&gt;child1().useKind() == UntypedUse);
</span><del>-        JSValueOperand argument(this, node-&gt;child1());
-        GPRTemporary result(this, Reuse, argument);
</del><ins>+        JSValueOperand op1(this, node-&gt;child1());
+        GPRTemporary result(this, Reuse, op1);
</ins><span class="cx">         
</span><del>-        GPRReg argumentGPR = argument.gpr();
</del><ins>+        GPRReg op1GPR = op1.gpr();
</ins><span class="cx">         GPRReg resultGPR = result.gpr();
</span><span class="cx">         
</span><del>-        argument.use();
</del><ins>+        op1.use();
</ins><span class="cx">         
</span><del>-        MacroAssembler::Jump alreadyPrimitive = m_jit.branchIfNotCell(JSValueRegs(argumentGPR));
-        MacroAssembler::Jump notPrimitive = m_jit.branchIfObject(argumentGPR);
</del><ins>+        MacroAssembler::Jump alreadyPrimitive = m_jit.branchIfNotCell(JSValueRegs(op1GPR));
+        MacroAssembler::Jump notPrimitive = m_jit.branchIfObject(op1GPR);
</ins><span class="cx">         
</span><span class="cx">         alreadyPrimitive.link(&amp;m_jit);
</span><del>-        m_jit.move(argumentGPR, resultGPR);
</del><ins>+        m_jit.move(op1GPR, resultGPR);
</ins><span class="cx">         
</span><span class="cx">         addSlowPathGenerator(
</span><del>-            slowPathCall(notPrimitive, this, operationToPrimitive, resultGPR, argumentGPR));
</del><ins>+            slowPathCall(notPrimitive, this, operationToPrimitive, resultGPR, op1GPR));
</ins><span class="cx">         
</span><span class="cx">         jsValueResult(resultGPR, node, UseChildrenCalledExplicitly);
</span><span class="cx">         break;
</span><span class="cx">     }
</span><del>-
-    case ToNumber: {
-        JSValueOperand argument(this, node-&gt;child1());
-        GPRTemporary result(this, Reuse, argument);
-
-        GPRReg argumentGPR = argument.gpr();
-        GPRReg resultGPR = result.gpr();
-
-        argument.use();
-
-        // We have several attempts to remove ToNumber. But ToNumber still exists.
-        // It means that converting non-numbers to numbers by this ToNumber is not rare.
-        // Instead of the slow path generator, we emit callOperation here.
-        if (!(m_state.forNode(node-&gt;child1()).m_type &amp; SpecBytecodeNumber)) {
-            flushRegisters();
-            callOperation(operationToNumber, resultGPR, argumentGPR);
-            m_jit.exceptionCheck();
-        } else {
-            MacroAssembler::Jump notNumber = m_jit.branchIfNotNumber(argumentGPR);
-            m_jit.move(argumentGPR, resultGPR);
-            MacroAssembler::Jump done = m_jit.jump();
-
-            notNumber.link(&amp;m_jit);
-            silentSpillAllRegisters(resultGPR);
-            callOperation(operationToNumber, resultGPR, argumentGPR);
-            silentFillAllRegisters(resultGPR);
-            m_jit.exceptionCheck();
-
-            done.link(&amp;m_jit);
-        }
-
-        jsValueResult(resultGPR, node, UseChildrenCalledExplicitly);
-        break;
-    }
</del><span class="cx">         
</span><span class="cx">     case ToString:
</span><span class="cx">     case CallStringConstructor: {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -161,9 +161,8 @@
</span><span class="cx">     case GetScope:
</span><span class="cx">     case GetCallee:
</span><span class="cx">     case GetArgumentCountIncludingThis:
</span><del>-    case ToNumber:
</del><ins>+    case CallObjectConstructor:
</ins><span class="cx">     case ToString:
</span><del>-    case CallObjectConstructor:
</del><span class="cx">     case CallStringConstructor:
</span><span class="cx">     case MakeRope:
</span><span class="cx">     case NewArrayWithSize:
</span><span class="lines">@@ -405,8 +404,6 @@
</span><span class="cx">             break;
</span><span class="cx">         if (node-&gt;isBinaryUseKind(BooleanUse))
</span><span class="cx">             break;
</span><del>-        if (node-&gt;isBinaryUseKind(UntypedUse))
-            break;
</del><span class="cx">         if (node-&gt;isBinaryUseKind(SymbolUse))
</span><span class="cx">             break;
</span><span class="cx">         if (node-&gt;isBinaryUseKind(MiscUse, UntypedUse))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -728,9 +728,6 @@
</span><span class="cx">         case ReallocatePropertyStorage:
</span><span class="cx">             compileReallocatePropertyStorage();
</span><span class="cx">             break;
</span><del>-        case ToNumber:
-            compileToNumber();
-            break;
</del><span class="cx">         case ToString:
</span><span class="cx">         case CallStringConstructor:
</span><span class="cx">             compileToStringOrCallStringConstructor();
</span><span class="lines">@@ -4102,33 +4099,6 @@
</span><span class="cx">             reallocatePropertyStorage(
</span><span class="cx">                 object, oldStorage, transition-&gt;previous, transition-&gt;next));
</span><span class="cx">     }
</span><del>-
-    void compileToNumber()
-    {
-        LValue value = lowJSValue(m_node-&gt;child1());
-
-        if (!(abstractValue(m_node-&gt;child1()).m_type &amp; SpecBytecodeNumber))
-            setJSValue(vmCall(m_out.int64, m_out.operation(operationToNumber), m_callFrame, value));
-        else {
-            LBasicBlock notNumber = m_out.newBlock();
-            LBasicBlock continuation = m_out.newBlock();
-
-            ValueFromBlock fastResult = m_out.anchor(value);
-            m_out.branch(isNumber(value, provenType(m_node-&gt;child1())), unsure(continuation), unsure(notNumber));
-
-            // notNumber case.
-            LBasicBlock lastNext = m_out.appendTo(notNumber, continuation);
-            // We have several attempts to remove ToNumber. But ToNumber still exists.
-            // It means that converting non-numbers to numbers by this ToNumber is not rare.
-            // Instead of the lazy slow path generator, we call the operation here.
-            ValueFromBlock slowResult = m_out.anchor(vmCall(m_out.int64, m_out.operation(operationToNumber), m_callFrame, value));
-            m_out.jump(continuation);
-
-            // continuation case.
-            m_out.appendTo(continuation, lastNext);
-            setJSValue(m_out.phi(m_out.int64, fastResult, slowResult));
-        }
-    }
</del><span class="cx">     
</span><span class="cx">     void compileToStringOrCallStringConstructor()
</span><span class="cx">     {
</span><span class="lines">@@ -4919,15 +4889,6 @@
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        if (m_node-&gt;isBinaryUseKind(UntypedUse)) {
-            nonSpeculativeCompare(
-                [&amp;] (LValue left, LValue right) {
-                    return m_out.equal(left, right);
-                },
-                operationCompareStrictEq);
-            return;
-        }
-
</del><span class="cx">         if (m_node-&gt;isBinaryUseKind(SymbolUse)) {
</span><span class="cx">             LValue left = lowSymbol(m_node-&gt;child1());
</span><span class="cx">             LValue right = lowSymbol(m_node-&gt;child2());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitAssemblyHelpersh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -755,7 +755,9 @@
</span><span class="cx">     {
</span><span class="cx"> #if USE(JSVALUE64)
</span><span class="cx">         UNUSED_PARAM(tempGPR);
</span><del>-        return branchIfNumber(regs.gpr(), mode);
</del><ins>+        if (mode == HaveTagRegisters)
+            return branchTest64(NonZero, regs.gpr(), GPRInfo::tagTypeNumberRegister);
+        return branchTest64(NonZero, regs.gpr(), TrustedImm64(TagTypeNumber));
</ins><span class="cx"> #else
</span><span class="cx">         UNUSED_PARAM(mode);
</span><span class="cx">         add32(TrustedImm32(1), regs.tagGPR(), tempGPR);
</span><span class="lines">@@ -762,15 +764,6 @@
</span><span class="cx">         return branch32(Below, tempGPR, TrustedImm32(JSValue::LowestTag + 1));
</span><span class="cx"> #endif
</span><span class="cx">     }
</span><del>-
-#if USE(JSVALUE64)
-    Jump branchIfNumber(GPRReg reg, TagRegistersMode mode = HaveTagRegisters)
-    {
-        if (mode == HaveTagRegisters)
-            return branchTest64(NonZero, reg, GPRInfo::tagTypeNumberRegister);
-        return branchTest64(NonZero, reg, TrustedImm64(TagTypeNumber));
-    }
-#endif
</del><span class="cx">     
</span><span class="cx">     // Note that the tempGPR is not used in 64-bit mode.
</span><span class="cx">     Jump branchIfNotNumber(JSValueRegs regs, GPRReg tempGPR, TagRegistersMode mode = HaveTagRegisters)
</span><span class="lines">@@ -777,7 +770,9 @@
</span><span class="cx">     {
</span><span class="cx"> #if USE(JSVALUE64)
</span><span class="cx">         UNUSED_PARAM(tempGPR);
</span><del>-        return branchIfNotNumber(regs.gpr(), mode);
</del><ins>+        if (mode == HaveTagRegisters)
+            return branchTest64(Zero, regs.gpr(), GPRInfo::tagTypeNumberRegister);
+        return branchTest64(Zero, regs.gpr(), TrustedImm64(TagTypeNumber));
</ins><span class="cx"> #else
</span><span class="cx">         UNUSED_PARAM(mode);
</span><span class="cx">         add32(TrustedImm32(1), regs.tagGPR(), tempGPR);
</span><span class="lines">@@ -785,15 +780,6 @@
</span><span class="cx"> #endif
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-#if USE(JSVALUE64)
-    Jump branchIfNotNumber(GPRReg reg, TagRegistersMode mode = HaveTagRegisters)
-    {
-        if (mode == HaveTagRegisters)
-            return branchTest64(Zero, reg, GPRInfo::tagTypeNumberRegister);
-        return branchTest64(Zero, reg, TrustedImm64(TagTypeNumber));
-    }
-#endif
-
</del><span class="cx">     Jump branchIfNotDoubleKnownNotInt32(JSValueRegs regs, TagRegistersMode mode = HaveTagRegisters)
</span><span class="cx">     {
</span><span class="cx"> #if USE(JSVALUE64)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOpcodescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -516,15 +516,12 @@
</span><span class="cx"> 
</span><span class="cx"> void JIT::emit_op_to_number(Instruction* currentInstruction)
</span><span class="cx"> {
</span><del>-    int dstVReg = currentInstruction[1].u.operand;
</del><span class="cx">     int srcVReg = currentInstruction[2].u.operand;
</span><span class="cx">     emitGetVirtualRegister(srcVReg, regT0);
</span><span class="cx">     
</span><span class="cx">     addSlowCase(emitJumpIfNotNumber(regT0));
</span><span class="cx"> 
</span><del>-    emitValueProfilingSite();
-    if (srcVReg != dstVReg)
-        emitPutVirtualRegister(dstVReg);
</del><ins>+    emitPutVirtualRegister(currentInstruction[1].u.operand);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT::emit_op_to_string(Instruction* currentInstruction)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOpcodes32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -828,7 +828,6 @@
</span><span class="cx">     addSlowCase(branch32(AboveOrEqual, regT1, TrustedImm32(JSValue::LowestTag)));
</span><span class="cx">     isInt32.link(this);
</span><span class="cx"> 
</span><del>-    emitValueProfilingSite();
</del><span class="cx">     if (src != dst)
</span><span class="cx">         emitStore(dst, regT1, regT0);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreter32_64asm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -955,8 +955,7 @@
</span><span class="cx"> .opToNumberIsInt:
</span><span class="cx">     storei t2, TagOffset[cfr, t1, 8]
</span><span class="cx">     storei t3, PayloadOffset[cfr, t1, 8]
</span><del>-    valueProfile(t2, t3, 12, t1)
-    dispatch(4)
</del><ins>+    dispatch(3)
</ins><span class="cx"> 
</span><span class="cx"> .opToNumberSlow:
</span><span class="cx">     callOpcodeSlowPath(_slow_path_to_number)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreter64asm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -834,12 +834,11 @@
</span><span class="cx">     btqz t2, tagTypeNumber, .opToNumberSlow
</span><span class="cx"> .opToNumberIsImmediate:
</span><span class="cx">     storeq t2, [cfr, t1, 8]
</span><del>-    valueProfile(t2, 3, t0)
-    dispatch(4)
</del><ins>+    dispatch(3)
</ins><span class="cx"> 
</span><span class="cx"> .opToNumberSlow:
</span><span class="cx">     callOpcodeSlowPath(_slow_path_to_number)
</span><del>-    dispatch(4)
</del><ins>+    dispatch(3)
</ins><span class="cx"> 
</span><span class="cx"> 
</span><span class="cx"> _llint_op_to_string:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreparserNodesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/parser/Nodes.h (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/parser/Nodes.h        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/parser/Nodes.h        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -967,11 +967,12 @@
</span><span class="cx">     protected:
</span><span class="cx">         ExpressionNode* expr() { return m_expr; }
</span><span class="cx">         const ExpressionNode* expr() const { return m_expr; }
</span><del>-        OpcodeID opcodeID() const { return m_opcodeID; }
</del><span class="cx"> 
</span><span class="cx">     private:
</span><span class="cx">         RegisterID* emitBytecode(BytecodeGenerator&amp;, RegisterID* = 0) override;
</span><span class="cx"> 
</span><ins>+        OpcodeID opcodeID() const { return m_opcodeID; }
+
</ins><span class="cx">         ExpressionNode* m_expr;
</span><span class="cx">         OpcodeID m_opcodeID;
</span><span class="cx">     };
</span><span class="lines">@@ -981,8 +982,6 @@
</span><span class="cx">         UnaryPlusNode(const JSTokenLocation&amp;, ExpressionNode*);
</span><span class="cx"> 
</span><span class="cx">     private:
</span><del>-        RegisterID* emitBytecode(BytecodeGenerator&amp;, RegisterID* = 0) override;
-
</del><span class="cx">         ExpressionNode* stripUnaryPlus() override { return expr(); }
</span><span class="cx">     };
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCommonSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -346,6 +346,12 @@
</span><span class="cx">     RETURN(jsNumber(OP(1).jsValue().toNumber(exec) - 1));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+SLOW_PATH_DECL(slow_path_to_number)
+{
+    BEGIN();
+    RETURN(jsNumber(OP_C(2).jsValue().toNumber(exec)));
+}
+
</ins><span class="cx"> SLOW_PATH_DECL(slow_path_to_string)
</span><span class="cx"> {
</span><span class="cx">     BEGIN();
</span><span class="lines">@@ -392,14 +398,6 @@
</span><span class="cx"> static void updateResultProfileForBinaryArithOp(ExecState*, Instruction*, JSValue, JSValue, JSValue) { }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-SLOW_PATH_DECL(slow_path_to_number)
-{
-    BEGIN();
-    JSValue argument = OP_C(2).jsValue();
-    JSValue result = jsNumber(argument.toNumber(exec));
-    RETURN_PROFILED(op_to_number, result);
-}
-
</del><span class="cx"> SLOW_PATH_DECL(slow_path_add)
</span><span class="cx"> {
</span><span class="cx">     BEGIN();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -211,8 +211,8 @@
</span><span class="cx"> /* Source for JSGlobalObject.lut.h
</span><span class="cx"> @begin globalObjectTable
</span><span class="cx">   parseFloat            globalFuncParseFloat                         DontEnum|Function 1
</span><del>-  isNaN                 JSBuiltin                                    DontEnum|Function 1
-  isFinite              JSBuiltin                                    DontEnum|Function 1
</del><ins>+  isNaN                 globalFuncIsNaN                              DontEnum|Function 1
+  isFinite              globalFuncIsFinite                           DontEnum|Function 1
</ins><span class="cx">   escape                globalFuncEscape                             DontEnum|Function 1
</span><span class="cx">   unescape              globalFuncUnescape                           DontEnum|Function 1
</span><span class="cx">   decodeURI             globalFuncDecodeURI                          DontEnum|Function 1
</span><span class="lines">@@ -402,7 +402,7 @@
</span><span class="cx">     m_objectStructureForObjectConstructor.set(vm, this, vm.prototypeMap.emptyObjectStructureForPrototype(m_objectPrototype.get(), JSFinalObject::defaultInlineCapacity()));
</span><span class="cx"> 
</span><span class="cx">     m_speciesGetterSetter.set(vm, this, GetterSetter::create(vm, this));
</span><del>-    m_speciesGetterSetter-&gt;setGetter(vm, this, JSFunction::createBuiltinFunction(vm, globalOperationsSpeciesGetterCodeGenerator(vm), this, &quot;get [Symbol.species]&quot;));
</del><ins>+    m_speciesGetterSetter-&gt;setGetter(vm, this, JSFunction::createBuiltinFunction(vm, globalObjectSpeciesGetterCodeGenerator(vm), this, &quot;get [Symbol.species]&quot;));
</ins><span class="cx"> 
</span><span class="cx">     m_typedArrayProto.initLater(
</span><span class="cx">         [] (const Initializer&lt;JSTypedArrayViewPrototype&gt;&amp; init) {
</span><span class="lines">@@ -647,6 +647,8 @@
</span><span class="cx"> 
</span><span class="cx">     JSFunction* privateFuncAbs = JSFunction::create(vm, this, 0, String(), mathProtoFuncAbs, AbsIntrinsic);
</span><span class="cx">     JSFunction* privateFuncFloor = JSFunction::create(vm, this, 0, String(), mathProtoFuncFloor, FloorIntrinsic);
</span><ins>+    JSFunction* privateFuncIsFinite = JSFunction::create(vm, this, 0, String(), globalFuncIsFinite);
+    JSFunction* privateFuncIsNaN = JSFunction::create(vm, this, 0, String(), globalFuncIsNaN);
</ins><span class="cx">     JSFunction* privateFuncTrunc = JSFunction::create(vm, this, 0, String(), mathProtoFuncTrunc, TruncIntrinsic);
</span><span class="cx"> 
</span><span class="cx">     JSFunction* privateFuncGetTemplateObject = JSFunction::create(vm, this, 0, String(), getTemplateObject);
</span><span class="lines">@@ -713,6 +715,8 @@
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().absPrivateName(), privateFuncAbs, DontEnum | DontDelete | ReadOnly),
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().floorPrivateName(), privateFuncFloor, DontEnum | DontDelete | ReadOnly),
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().truncPrivateName(), privateFuncTrunc, DontEnum | DontDelete | ReadOnly),
</span><ins>+        GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().isFinitePrivateName(), privateFuncIsFinite, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().isNaNPrivateName(), privateFuncIsNaN, DontEnum | DontDelete | ReadOnly),
</ins><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().PromisePrivateName(), promiseConstructor, DontEnum | DontDelete | ReadOnly),
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().ReflectPrivateName(), reflectObject, DontEnum | DontDelete | ReadOnly),
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;builtinNames().InternalPromisePrivateName(), internalPromiseConstructor, DontEnum | DontDelete | ReadOnly),
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -706,6 +706,17 @@
</span><span class="cx">     return JSValue::encode(jsNumber(parseFloat(exec-&gt;argument(0).toString(exec)-&gt;view(exec).get())));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+EncodedJSValue JSC_HOST_CALL globalFuncIsNaN(ExecState* exec)
+{
+    return JSValue::encode(jsBoolean(std::isnan(exec-&gt;argument(0).toNumber(exec))));
+}
+
+EncodedJSValue JSC_HOST_CALL globalFuncIsFinite(ExecState* exec)
+{
+    double n = exec-&gt;argument(0).toNumber(exec);
+    return JSValue::encode(jsBoolean(std::isfinite(n)));
+}
+
</ins><span class="cx"> EncodedJSValue JSC_HOST_CALL globalFuncDecodeURI(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     static Bitmap&lt;256&gt; doNotUnescapeWhenDecodingURI = makeCharacterBitmap(
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -40,6 +40,8 @@
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL globalFuncEval(ExecState*);
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL globalFuncParseInt(ExecState*);
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL globalFuncParseFloat(ExecState*);
</span><ins>+EncodedJSValue JSC_HOST_CALL globalFuncIsNaN(ExecState*);
+EncodedJSValue JSC_HOST_CALL globalFuncIsFinite(ExecState*);
</ins><span class="cx"> EncodedJSValue JSC_HOST_CALL globalFuncDecodeURI(ExecState*);
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL globalFuncDecodeURIComponent(ExecState*);
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL globalFuncEncodeURI(ExecState*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMathCommonh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MathCommon.h (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MathCommon.h        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/runtime/MathCommon.h        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -35,18 +35,6 @@
</span><span class="cx"> double JIT_OPERATION operationMathPow(double x, double y) WTF_INTERNAL;
</span><span class="cx"> int32_t JIT_OPERATION operationToInt32(double) WTF_INTERNAL;
</span><span class="cx"> 
</span><del>-inline constexpr double maxSafeInteger()
-{
-    // 2 ^ 53 - 1
-    return 9007199254740991.0;
-}
-
-inline constexpr double minSafeInteger()
-{
-    // -(2 ^ 53 - 1)
-    return -9007199254740991.0;
-}
-
</del><span class="cx"> inline int clz32(uint32_t number)
</span><span class="cx"> {
</span><span class="cx"> #if COMPILER(GCC_OR_CLANG)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeNumberConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -31,29 +31,19 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><ins>+static EncodedJSValue JSC_HOST_CALL numberConstructorFuncIsFinite(ExecState*);
</ins><span class="cx"> static EncodedJSValue JSC_HOST_CALL numberConstructorFuncIsInteger(ExecState*);
</span><ins>+static EncodedJSValue JSC_HOST_CALL numberConstructorFuncIsNaN(ExecState*);
</ins><span class="cx"> static EncodedJSValue JSC_HOST_CALL numberConstructorFuncIsSafeInteger(ExecState*);
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span><span class="cx"> 
</span><del>-#include &quot;NumberConstructor.lut.h&quot;
-
</del><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="cx"> STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(NumberConstructor);
</span><span class="cx"> 
</span><del>-const ClassInfo NumberConstructor::s_info = { &quot;Function&quot;, &amp;InternalFunction::s_info, &amp;numberConstructorTable, CREATE_METHOD_TABLE(NumberConstructor) };
</del><ins>+const ClassInfo NumberConstructor::s_info = { &quot;Function&quot;, &amp;InternalFunction::s_info, 0, CREATE_METHOD_TABLE(NumberConstructor) };
</ins><span class="cx"> 
</span><del>-/* Source for NumberConstructor.lut.h
-@begin numberConstructorTable
-  isFinite       JSBuiltin                           DontEnum|Function 1
-  isInteger      numberConstructorFuncIsInteger      DontEnum|Function 1
-  isNaN          JSBuiltin                           DontEnum|Function 1
-  isSafeInteger  numberConstructorFuncIsSafeInteger  DontEnum|Function 1
-  parseFloat     globalFuncParseFloat                DontEnum|Function 1
-@end
-*/
-
</del><span class="cx"> NumberConstructor::NumberConstructor(VM&amp; vm, Structure* structure)
</span><span class="cx">     : InternalFunction(vm, structure)
</span><span class="cx"> {
</span><span class="lines">@@ -73,12 +63,17 @@
</span><span class="cx">     putDirectWithoutTransition(vm, Identifier::fromString(&amp;vm, &quot;EPSILON&quot;), jsDoubleNumber(std::numeric_limits&lt;double&gt;::epsilon()), DontDelete | DontEnum | ReadOnly);
</span><span class="cx">     putDirectWithoutTransition(vm, Identifier::fromString(&amp;vm, &quot;MAX_VALUE&quot;), jsDoubleNumber(1.7976931348623157E+308), DontDelete | DontEnum | ReadOnly);
</span><span class="cx">     putDirectWithoutTransition(vm, Identifier::fromString(&amp;vm, &quot;MIN_VALUE&quot;), jsDoubleNumber(5E-324), DontDelete | DontEnum | ReadOnly);
</span><del>-    putDirectWithoutTransition(vm, Identifier::fromString(&amp;vm, &quot;MAX_SAFE_INTEGER&quot;), jsDoubleNumber(maxSafeInteger()), DontDelete | DontEnum | ReadOnly);
-    putDirectWithoutTransition(vm, Identifier::fromString(&amp;vm, &quot;MIN_SAFE_INTEGER&quot;), jsDoubleNumber(minSafeInteger()), DontDelete | DontEnum | ReadOnly);
</del><ins>+    putDirectWithoutTransition(vm, Identifier::fromString(&amp;vm, &quot;MAX_SAFE_INTEGER&quot;), jsDoubleNumber(9007199254740991.0), DontDelete | DontEnum | ReadOnly);
+    putDirectWithoutTransition(vm, Identifier::fromString(&amp;vm, &quot;MIN_SAFE_INTEGER&quot;), jsDoubleNumber(-9007199254740991.0), DontDelete | DontEnum | ReadOnly);
</ins><span class="cx">     putDirectWithoutTransition(vm, Identifier::fromString(&amp;vm, &quot;NEGATIVE_INFINITY&quot;), jsDoubleNumber(-std::numeric_limits&lt;double&gt;::infinity()), DontDelete | DontEnum | ReadOnly);
</span><span class="cx">     putDirectWithoutTransition(vm, Identifier::fromString(&amp;vm, &quot;POSITIVE_INFINITY&quot;), jsDoubleNumber(std::numeric_limits&lt;double&gt;::infinity()), DontDelete | DontEnum | ReadOnly);
</span><span class="cx">     putDirectWithoutTransition(vm, Identifier::fromString(&amp;vm, &quot;NaN&quot;), jsNaN(), DontDelete | DontEnum | ReadOnly);
</span><span class="cx"> 
</span><ins>+    putDirectNativeFunctionWithoutTransition(vm, numberPrototype-&gt;globalObject(), Identifier::fromString(&amp;vm, &quot;isFinite&quot;), 1, numberConstructorFuncIsFinite, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, numberPrototype-&gt;globalObject(), Identifier::fromString(&amp;vm, &quot;isInteger&quot;), 1, numberConstructorFuncIsInteger, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, numberPrototype-&gt;globalObject(), Identifier::fromString(&amp;vm, &quot;isNaN&quot;), 1, numberConstructorFuncIsNaN, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, numberPrototype-&gt;globalObject(), Identifier::fromString(&amp;vm, &quot;isSafeInteger&quot;), 1, numberConstructorFuncIsSafeInteger, NoIntrinsic, DontEnum);
+    putDirectNativeFunctionWithoutTransition(vm, numberPrototype-&gt;globalObject(), Identifier::fromString(&amp;vm, &quot;parseFloat&quot;), 1, globalFuncParseFloat, NoIntrinsic, DontEnum);
</ins><span class="cx">     putDirectWithoutTransition(vm, Identifier::fromString(&amp;vm, &quot;parseInt&quot;), numberPrototype-&gt;globalObject()-&gt;parseIntFunction(), DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -113,6 +108,13 @@
</span><span class="cx">     return CallType::Host;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+// ECMA-262 20.1.2.2
+static EncodedJSValue JSC_HOST_CALL numberConstructorFuncIsFinite(ExecState* exec)
+{
+    JSValue argument = exec-&gt;argument(0);
+    return JSValue::encode(jsBoolean(argument.isNumber() &amp;&amp; (argument.isInt32() || std::isfinite(argument.asDouble()))));
+}
+
</ins><span class="cx"> // ECMA-262 20.1.2.3
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL numberConstructorFuncIsInteger(ExecState* exec)
</span><span class="cx"> {
</span><span class="lines">@@ -129,6 +131,13 @@
</span><span class="cx">     return JSValue::encode(jsBoolean(isInteger));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+// ECMA-262 20.1.2.4
+static EncodedJSValue JSC_HOST_CALL numberConstructorFuncIsNaN(ExecState* exec)
+{
+    JSValue argument = exec-&gt;argument(0);
+    return JSValue::encode(jsBoolean(argument.isDouble() &amp;&amp; std::isnan(argument.asDouble())));
+}
+
</ins><span class="cx"> // ECMA-262 20.1.2.5
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL numberConstructorFuncIsSafeInteger(ExecState* exec)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeNumberConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NumberConstructor.h (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/NumberConstructor.h        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/runtime/NumberConstructor.h        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -31,7 +31,7 @@
</span><span class="cx"> class NumberConstructor : public InternalFunction {
</span><span class="cx"> public:
</span><span class="cx">     typedef InternalFunction Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | ImplementsHasInstance | HasStaticPropertyTable;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | ImplementsHasInstance | ImplementsDefaultHasInstance;
</ins><span class="cx"> 
</span><span class="cx">     static NumberConstructor* create(VM&amp; vm, Structure* structure, NumberPrototype* numberPrototype, GetterSetter*)
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressNumberisNaNbasicsjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/Number-isNaN-basics.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/Number-isNaN-basics.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/Number-isNaN-basics.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,221 +0,0 @@
</span><del>-function numberIsNaNOnInteger(value)
-{
-    return Number.isNaN(value);
-}
-noInline(numberIsNaNOnInteger);
-
-// *** Test simple cases on integers. ***
-function testNumberIsNaNOnIntegers()
-{
-    // Bounds.
-    var value = numberIsNaNOnInteger(0);
-    if (value)
-        throw &quot;numberIsNaNOnInteger(0) = &quot; + value;
-
-    var value = numberIsNaNOnInteger(-2147483648);
-    if (value)
-        throw &quot;numberIsNaNOnInteger(-2147483648) = &quot; + value;
-
-    var value = numberIsNaNOnInteger(2147483647);
-    if (value)
-        throw &quot;numberIsNaNOnInteger(2147483647) = &quot; + value;
-
-    // Simple values.
-    var value = numberIsNaNOnInteger(-1);
-    if (value)
-        throw &quot;numberIsNaNOnInteger(-1) = &quot; + value;
-
-    var value = numberIsNaNOnInteger(42);
-    if (value)
-        throw &quot;numberIsNaNOnInteger(42) = &quot; + value;
-
-    var value = numberIsNaNOnInteger(-42);
-    if (value)
-        throw &quot;numberIsNaNOnInteger(-42) = &quot; + value;
-}
-noInline(testNumberIsNaNOnIntegers);
-
-for (var i = 0; i &lt; 1e4; ++i) {
-    testNumberIsNaNOnIntegers();
-}
-
-// Make sure we don't do anything stupid when the type is unexpected.
-function verifyNumberIsNaNOnIntegerWithOtherTypes()
-{
-    var value = numberIsNaNOnInteger(Math.PI);
-    if (value)
-        throw &quot;numberIsNaNOnInteger(Math.PI) = &quot; + value;
-
-    var value = numberIsNaNOnInteger(&quot;42&quot;);
-    if (value)
-        throw &quot;numberIsNaNOnInteger(\&quot;42\&quot;) = &quot; + value;
-
-    var value = numberIsNaNOnInteger(&quot;WebKit&quot;);
-    if (value)
-        throw &quot;numberIsNaNOnInteger(\&quot;WebKit\&quot;) = &quot; + value;
-
-    var value = numberIsNaNOnInteger(-0);
-    if (value)
-        throw &quot;numberIsNaNOnInteger(-0) = &quot; + value;
-}
-noInline(verifyNumberIsNaNOnIntegerWithOtherTypes);
-
-for (var i = 0; i &lt; 1e4; ++i) {
-    verifyNumberIsNaNOnIntegerWithOtherTypes();
-}
-
-
-// *** Test simple cases on doubles. ***
-function numberIsNaNOnDouble(value)
-{
-    return Number.isNaN(value);
-}
-noInline(numberIsNaNOnDouble);
-
-// Test simple cases on doubles.
-function testNumberIsNaNOnDoubles()
-{
-    var value = numberIsNaNOnDouble(Math.PI);
-    if (value)
-        throw &quot;numberIsNaNOnDouble(Math.PI) = &quot; + value;
-
-    var value = numberIsNaNOnDouble(Math.E);
-    if (value)
-        throw &quot;numberIsNaNOnDouble(Math.E) = &quot; + value;
-
-    var value = numberIsNaNOnDouble(Math.LN2);
-    if (value)
-        throw &quot;numberIsNaNOnDouble(Math.LN2) = &quot; + value;
-
-    var value = numberIsNaNOnDouble(-0);
-    if (value)
-        throw &quot;numberIsNaNOnDouble(-0) = &quot; + value;
-
-    var value = numberIsNaNOnDouble(NaN);
-    if (!value)
-        throw &quot;numberIsNaNOnDouble(NaN) = &quot; + value;
-
-    var value = numberIsNaNOnDouble(Number.POSITIVE_INFINITY);
-    if (value)
-        throw &quot;numberIsNaNOnDouble(Number.POSITIVE_INFINITY) = &quot; + value;
-
-    var value = numberIsNaNOnDouble(Number.NEGATIVE_INFINITY);
-    if (value)
-        throw &quot;numberIsNaNOnDouble(Number.NEGATIVE_INFINITY) = &quot; + value;
-}
-noInline(testNumberIsNaNOnDoubles);
-
-for (var i = 0; i &lt; 1e4; ++i) {
-    testNumberIsNaNOnDoubles();
-}
-
-// Make sure we don't do anything stupid when the type is unexpected.
-function verifyNumberIsNaNOnDoublesWithOtherTypes()
-{
-    var value = numberIsNaNOnDouble(1);
-    if (value)
-        throw &quot;numberIsNaNOnDouble(1) = &quot; + value;
-
-    var value = numberIsNaNOnDouble(&quot;42&quot;);
-    if (value)
-        throw &quot;numberIsNaNOnDouble(\&quot;42\&quot;) = &quot; + value;
-
-    var value = numberIsNaNOnDouble(&quot;WebKit&quot;);
-    if (value)
-        throw &quot;numberIsNaNOnDouble(\&quot;WebKit\&quot;) = &quot; + value;
-
-    var value = numberIsNaNOnDouble({});
-    if (value)
-        throw &quot;numberIsNaNOnDouble({}) = &quot; + value;
-}
-noInline(verifyNumberIsNaNOnDoublesWithOtherTypes);
-
-for (var i = 0; i &lt; 1e4; ++i) {
-    verifyNumberIsNaNOnDoublesWithOtherTypes();
-}
-
-
-// *** Unusual arguments. ***
-function numberIsNaNNoArguments()
-{
-    return Number.isNaN();
-}
-noInline(numberIsNaNNoArguments);
-
-function numberIsNaNTooManyArguments(a, b, c)
-{
-    return Number.isNaN(a, b, c);
-}
-noInline(numberIsNaNTooManyArguments);
-
-
-for (var i = 0; i &lt; 1e4; ++i) {
-    var value = numberIsNaNNoArguments();
-    if (value)
-        throw &quot;numberIsNaNNoArguments() = &quot; + value;
-
-    value = numberIsNaNTooManyArguments(2, 3, 5);
-    if (value)
-        throw &quot;numberIsNaNTooManyArguments() = &quot; + value;
-}
-
-
-// *** Constant as arguments. ***
-function testNumberIsNaNOnConstants()
-{
-    var value = Number.isNaN(0);
-    if (value)
-        throw &quot;Number.isNaN(0) = &quot; + value;
-    var value = Number.isNaN(-0);
-    if (value)
-        throw &quot;Number.isNaN(-0) = &quot; + value;
-    var value = Number.isNaN(1);
-    if (value)
-        throw &quot;Number.isNaN(1) = &quot; + value;
-    var value = Number.isNaN(-1);
-    if (value)
-        throw &quot;Number.isNaN(-1) = &quot; + value;
-    var value = Number.isNaN(42);
-    if (value)
-        throw &quot;Number.isNaN(42) = &quot; + value;
-    var value = Number.isNaN(-42);
-    if (value)
-        throw &quot;Number.isNaN(-42) = &quot; + value;
-    var value = Number.isNaN(Number.POSITIVE_INFINITY);
-    if (value)
-        throw &quot;Number.isNaN(Number.POSITIVE_INFINITY) = &quot; + value;
-    var value = Number.isNaN(Number.NEGATIVE_INFINITY);
-    if (value)
-        throw &quot;Number.isNaN(Number.NEGATIVE_INFINITY) = &quot; + value;
-    var value = Number.isNaN(Math.E);
-    if (value)
-        throw &quot;Number.isNaN(Math.E) = &quot; + value;
-    var value = Number.isNaN(NaN);
-    if (!value)
-        throw &quot;Number.isNaN(NaN) = &quot; + value;
-}
-noInline(testNumberIsNaNOnConstants);
-
-for (var i = 0; i &lt; 1e4; ++i) {
-    testNumberIsNaNOnConstants();
-}
-
-
-// *** Struct transition. ***
-function numberIsNaNStructTransition(value)
-{
-    return Number.isNaN(value);
-}
-noInline(numberIsNaNStructTransition);
-
-for (var i = 0; i &lt; 1e4; ++i) {
-    var value = numberIsNaNStructTransition(42);
-    if (value)
-        throw &quot;numberIsNaNStructTransition(42) = &quot; + value;
-}
-
-Number.isNaN = function() { return 123; }
-
-var value = numberIsNaNStructTransition(42);
-if (value !== 123)
-    throw &quot;numberIsNaNStructTransition(42) after transition = &quot; + value;
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressglobalisfinitejs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/global-is-finite.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/global-is-finite.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/global-is-finite.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,18 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error(`bad value: ${actual}`);
-}
-for (var i = -1e4; i &lt; 1e4; ++i)
-    shouldBe(isFinite(i), true);
-
-// Emit DoubleRep.
-for (var i = 0; i &lt; 1e4; ++i) {
-    shouldBe(isFinite(Infinity), false);
-    shouldBe(isFinite(-Infinity), false);
-    shouldBe(isFinite(NaN), false);
-}
-
-// Emit ToNumber.
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(isFinite(&quot;0&quot;), true);
-shouldBe(isFinite(&quot;Hello&quot;), false);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressglobalisnanjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/global-is-nan.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/global-is-nan.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/global-is-nan.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,19 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error(`bad value: ${actual}`);
-}
-for (var i = -1e4; i &lt; 1e4; ++i)
-    shouldBe(isNaN(i), false);
-
-// Emit DoubleRep.
-for (var i = 0; i &lt; 1e4; ++i) {
-    shouldBe(isNaN(Infinity), false);
-    shouldBe(isNaN(-Infinity), false);
-    shouldBe(isNaN(NaN), true);
-}
-
-// Emit ToNumber.
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(isNaN(&quot;0&quot;), false);
-shouldBe(isNaN(&quot;Hello&quot;), true);
-shouldBe(isNaN(&quot;NaN&quot;), true);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressglobalisNaNbasicsjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/global-isNaN-basics.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/global-isNaN-basics.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/global-isNaN-basics.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,260 +0,0 @@
</span><del>-function isNaNOnInteger(value)
-{
-    return isNaN(value);
-}
-noInline(isNaNOnInteger);
-
-// *** Test simple cases on integers. ***
-function testIsNaNOnIntegers()
-{
-    // Bounds.
-    var value = isNaNOnInteger(0);
-    if (value)
-        throw &quot;isNaNOnInteger(0) = &quot; + value;
-
-    var value = isNaNOnInteger(-2147483648);
-    if (value)
-        throw &quot;isNaNOnInteger(-2147483648) = &quot; + value;
-
-    var value = isNaNOnInteger(2147483647);
-    if (value)
-        throw &quot;isNaNOnInteger(2147483647) = &quot; + value;
-
-    // Simple values.
-    var value = isNaNOnInteger(-1);
-    if (value)
-        throw &quot;isNaNOnInteger(-1) = &quot; + value;
-
-    var value = isNaNOnInteger(42);
-    if (value)
-        throw &quot;isNaNOnInteger(42) = &quot; + value;
-
-    var value = isNaNOnInteger(-42);
-    if (value)
-        throw &quot;isNaNOnInteger(-42) = &quot; + value;
-}
-noInline(testIsNaNOnIntegers);
-
-for (var i = 0; i &lt; 1e4; ++i) {
-    testIsNaNOnIntegers();
-}
-
-// Make sure we don't do anything stupid when the type is unexpected.
-function verifyIsNaNOnIntegerWithOtherTypes()
-{
-    var value = isNaNOnInteger(Math.PI);
-    if (value)
-        throw &quot;isNaNOnInteger(Math.PI) = &quot; + value;
-
-    var value = isNaNOnInteger(&quot;42&quot;);
-    if (value)
-        throw &quot;isNaNOnInteger(\&quot;42\&quot;) = &quot; + value;
-
-    var value = isNaNOnInteger(&quot;WebKit&quot;);
-    if (!value)
-        throw &quot;isNaNOnInteger(\&quot;WebKit\&quot;) = &quot; + value;
-
-    var value = isNaNOnInteger(-0);
-    if (value)
-        throw &quot;isNaNOnInteger(-0) = &quot; + value;
-}
-noInline(verifyIsNaNOnIntegerWithOtherTypes);
-
-for (var i = 0; i &lt; 1e4; ++i) {
-    verifyIsNaNOnIntegerWithOtherTypes();
-}
-
-// *** Test simple cases on doubles. ***
-function isNaNOnDouble(value)
-{
-    return isNaN(value);
-}
-noInline(isNaNOnDouble);
-
-// Test simple cases on doubles.
-function testIsNaNOnDoubles()
-{
-    var value = isNaNOnDouble(Math.PI);
-    if (value)
-        throw &quot;isNaNOnDouble(Math.PI) = &quot; + value;
-
-    var value = isNaNOnDouble(Math.E);
-    if (value)
-        throw &quot;isNaNOnDouble(Math.E) = &quot; + value;
-
-    var value = isNaNOnDouble(Math.LN2);
-    if (value)
-        throw &quot;isNaNOnDouble(Math.LN2) = &quot; + value;
-
-    var value = isNaNOnDouble(-0);
-    if (value)
-        throw &quot;isNaNOnDouble(-0) = &quot; + value;
-
-    var value = isNaNOnDouble(NaN);
-    if (!value)
-        throw &quot;isNaNOnDouble(NaN) = &quot; + value;
-
-    var value = isNaNOnDouble(Number.POSITIVE_INFINITY);
-    if (value)
-        throw &quot;isNaNOnDouble(Number.POSITIVE_INFINITY) = &quot; + value;
-
-    var value = isNaNOnDouble(Number.NEGATIVE_INFINITY);
-    if (value)
-        throw &quot;isNaNOnDouble(Number.NEGATIVE_INFINITY) = &quot; + value;
-}
-noInline(testIsNaNOnDoubles);
-
-for (var i = 0; i &lt; 1e6; ++i) {
-    testIsNaNOnDoubles();
-}
-
-// Make sure we don't do anything stupid when the type is unexpected.
-function verifyIsNaNOnDoublesWithOtherTypes()
-{
-    var value = isNaNOnDouble(1);
-    if (value)
-        throw &quot;isNaNOnDouble(1) = &quot; + value;
-
-    var value = isNaNOnDouble(&quot;42&quot;);
-    if (value)
-        throw &quot;isNaNOnDouble(\&quot;42\&quot;) = &quot; + value;
-
-    var value = isNaNOnDouble(&quot;WebKit&quot;);
-    if (!value)
-        throw &quot;isNaNOnDouble(\&quot;WebKit\&quot;) = &quot; + value;
-
-    var value = isNaNOnDouble({});
-    if (!value)
-        throw &quot;isNaNOnDouble({}) = &quot; + value;
-}
-noInline(verifyIsNaNOnDoublesWithOtherTypes);
-
-for (var i = 0; i &lt; 1e4; ++i) {
-    verifyIsNaNOnDoublesWithOtherTypes();
-}
-
-// Make sure we still return NaN for type coerced values for global isNaN.
-function verifyIsNaNOnCoercedTypes()
-{
-    var value = isNaNOnInteger(&quot;NaN&quot;);
-    if (!value)
-        throw &quot;isNaNOnInteger(\&quot;NaN\&quot;) = &quot; + value;
-
-    var value = isNaNOnInteger({ valueOf() { return NaN; } });
-    if (!value)
-        throw &quot;isNaNOnInteger({ valueOf() { return NaN; } }) = &quot; + value;
-}
-noInline(verifyIsNaNOnCoercedTypes);
-
-for (var i = 0; i &lt; 1e4; ++i) {
-    verifyIsNaNOnCoercedTypes();
-}
-
-
-// *** Unusual arguments. ***
-function isNaNNoArguments()
-{
-    return isNaN();
-}
-noInline(isNaNNoArguments);
-
-function isNaNTooManyArguments(a, b, c)
-{
-    return isNaN(a, b, c);
-}
-noInline(isNaNTooManyArguments);
-
-
-for (var i = 0; i &lt; 1e4; ++i) {
-    var value = isNaNNoArguments();
-    if (!value)
-        throw &quot;isNaNNoArguments() = &quot; + value;
-
-    value = isNaNTooManyArguments(2, 3, 5);
-    if (value)
-        throw &quot;isNaNTooManyArguments() = &quot; + value;
-}
-
-
-// *** Constant as arguments. ***
-function testIsNaNOnConstants()
-{
-    var value = isNaN(0);
-    if (value)
-        throw &quot;isNaN(0) = &quot; + value;
-    var value = isNaN(-0);
-    if (value)
-        throw &quot;isNaN(-0) = &quot; + value;
-    var value = isNaN(1);
-    if (value)
-        throw &quot;isNaN(1) = &quot; + value;
-    var value = isNaN(-1);
-    if (value)
-        throw &quot;isNaN(-1) = &quot; + value;
-    var value = isNaN(42);
-    if (value)
-        throw &quot;isNaN(42) = &quot; + value;
-    var value = isNaN(-42);
-    if (value)
-        throw &quot;isNaN(-42) = &quot; + value;
-    var value = isNaN(Number.POSITIVE_INFINITY);
-    if (value)
-        throw &quot;isNaN(Number.POSITIVE_INFINITY) = &quot; + value;
-    var value = isNaN(Number.NEGATIVE_INFINITY);
-    if (value)
-        throw &quot;isNaN(Number.NEGATIVE_INFINITY) = &quot; + value;
-    var value = isNaN(Math.E);
-    if (value)
-        throw &quot;isNaN(Math.E) = &quot; + value;
-    var value = isNaN(NaN);
-    if (!value)
-        throw &quot;isNaN(NaN) = &quot; + value;
-}
-noInline(testIsNaNOnConstants);
-
-for (var i = 0; i &lt; 1e4; ++i) {
-    testIsNaNOnConstants();
-}
-
-
-// *** Type Coercion Side effects. ***
-function isNaNTypeCoercionSideEffects(value)
-{
-    return isNaN(value);
-}
-noInline(isNaNTypeCoercionSideEffects);
-
-for (var i = 0; i &lt; 1e4; ++i) {
-    var value = isNaNTypeCoercionSideEffects(42);
-    if (value)
-        throw &quot;isNaNTypeCoercionSideEffects(42) = &quot; + value;
-}
-
-var globalCounter = 0;
-for (var i = 0; i &lt; 1e4; ++i) {
-    var value = isNaNTypeCoercionSideEffects({ valueOf() { return globalCounter++; } });
-    if (value)
-        throw &quot;isNaNTypeCoercionSideEffects({ valueOf() { return globalCounter++; } }) = &quot; + value;
-}
-if (globalCounter !== 1e4)
-    throw &quot;globalCounter =&quot; + globalCounter;
-
-
-// *** Struct transition. ***
-function isNaNStructTransition(value)
-{
-    return isNaN(value);
-}
-noInline(isNaNStructTransition);
-
-for (var i = 0; i &lt; 1e4; ++i) {
-    var value = isNaNStructTransition(42);
-    if (value)
-        throw &quot;isNaNStructTransition(42) = &quot; + value;
-}
-
-isNaN = function() { return 123; }
-
-var value = isNaNStructTransition(42);
-if (value !== 123)
-    throw &quot;isNaNStructTransition(42) after transition = &quot; + value;
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressnumberisfinitejs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/number-is-finite.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/number-is-finite.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/number-is-finite.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,37 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error(`bad value: ${actual}`);
-}
-
-function test1(i)
-{
-    shouldBe(Number.isFinite(i), true);
-}
-noInline(test1);
-
-for (var i = -1e4; i &lt; 1e4; ++i)
-    test1(i);
-
-function test2(i)
-{
-    shouldBe(Number.isFinite(Infinity), false);
-    shouldBe(Number.isFinite(-Infinity), false);
-    shouldBe(Number.isFinite(NaN), false);
-}
-noInline(test2);
-
-// Emit DoubleRep.
-for (var i = 0; i &lt; 100; ++i)
-    test2(i);
-
-
-function test3(i)
-{
-    shouldBe(Number.isFinite(&quot;0&quot;), false);
-    shouldBe(Number.isFinite(&quot;Hello&quot;), false);
-}
-noInline(test3);
-
-// Emit IsNumber.
-for (var i = 0; i &lt; 100; ++i)
-    test3(i);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressnumberisnanjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/number-is-nan.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/number-is-nan.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/number-is-nan.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,38 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error(`bad value: ${actual}`);
-}
-
-function test1(i)
-{
-    shouldBe(Number.isNaN(i), false);
-}
-noInline(test1);
-
-for (var i = -1e4; i &lt; 1e4; ++i)
-    test1(i);
-
-function test2(i)
-{
-    shouldBe(Number.isNaN(Infinity), false);
-    shouldBe(Number.isNaN(-Infinity), false);
-    shouldBe(Number.isNaN(NaN), true);
-}
-noInline(test2);
-
-// Emit DoubleRep.
-for (var i = 0; i &lt; 100; ++i)
-    test2(i);
-
-
-function test3(i)
-{
-    shouldBe(Number.isNaN(&quot;0&quot;), false);
-    shouldBe(Number.isNaN(&quot;Hello&quot;), false);
-    shouldBe(Number.isNaN(&quot;NaN&quot;), false);
-}
-noInline(test3);
-
-// Emit IsNumber.
-for (var i = 0; i &lt; 100; ++i)
-    test3(i);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstonumberbasicsjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/to-number-basics.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/to-number-basics.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/to-number-basics.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,22 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error(`bad value: ${String(actual)}`);
-}
-
-function test1(value)
-{
-    return Number(value) &lt;= 42;
-}
-noInline(test1);
-
-// Int32.
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test1(42), true);
-
-// Doubles.
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test1(42.195), false);
-
-// Non numbers.
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test1(&quot;Hello&quot;), false);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstonumberconvertidentitywithoutexecutionjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/to-number-convert-identity-without-execution.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/to-number-convert-identity-without-execution.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/to-number-convert-identity-without-execution.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,26 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error(`bad value: ${String(actual)}`);
-}
-
-function test(x, y)
-{
-    if (x)
-        return Number(y);
-    return y;
-}
-noInline(test);
-
-// Converted to Identity, but since Number is handled by inlining, it emits ForceOSRExit.
-// So converted Identity is never executed.
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(false, 41), 41);
-
-
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(true, 41), 41);
-var object = { valueOf() { return 41; } };
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(true, object), 41);
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(true, { valueOf() { return 42.195; } }), 42.195);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstonumberint52js"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/to-number-int52.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/to-number-int52.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/to-number-int52.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,29 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error(`bad value: ${String(actual)}`);
-}
-
-function test(x) {
-    var y = x;
-    var z = y * 2;
-    if (z) {
-        z += y;
-        z += y;
-        z += y;
-    }
-    return Number(z) &lt; 42;
-}
-noInline(test);
-
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(1000000000), false);
-
-// Extend to Doubles.
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(42.195), false);
-
-// Leave ToNumber for objects.
-// And this should update the value profiling to accept doubles in ToNumber calls.
-var object = { valueOf() { return 42.195; } };
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(object), false);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstonumberintrinsicconverttoidentitywithoutexecutionjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-convert-to-identity-without-execution.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-convert-to-identity-without-execution.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-convert-to-identity-without-execution.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,22 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error(`bad value: ${String(actual)}`);
-}
-
-function test(x, y)
-{
-    if (x)
-        return +y;
-    return y;
-}
-noInline(test);
-
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(false, 41), 41);
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(true, 41), 41);
-var object = { valueOf() { return 41; } };
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(true, object), 41);
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(true, { valueOf() { return 42.195; } }), 42.195);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstonumberintrinsicint52js"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-int52.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-int52.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-int52.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,29 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error(`bad value: ${String(actual)}`);
-}
-
-function test(x) {
-    var y = x;
-    var z = y * 2;
-    if (z) {
-        z += y;
-        z += y;
-        z += y;
-    }
-    return isFinite(z);
-}
-noInline(test);
-
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(1000000000), true);
-
-// Extend to Doubles.
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(42.195), true);
-
-// Leave ToNumber for objects.
-// And this should update the value profiling to accept doubles in ToNumber calls.
-var object = { valueOf() { return 42.195; } };
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(object), true);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstonumberintrinsicobjectwithoutexecutionjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-object-without-execution.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-object-without-execution.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-object-without-execution.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,18 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error(`bad value: ${String(actual)}`);
-}
-
-function test(x, y)
-{
-    if (x)
-        return +y;
-    return y;
-}
-noInline(test);
-
-var object = { valueOf() { return 41; } };
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(false, object), object);
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(true, object), 41);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstonumberintrinsicvalueprofilingjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-value-profiling.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-value-profiling.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/to-number-intrinsic-value-profiling.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,18 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error(`bad value: ${String(actual)}`);
-}
-
-function test(x) {
-    return isFinite(x);
-}
-noInline(test);
-
-var object = { valueOf() { return 42; } };
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(object), true);
-
-// This should update the value profiling to accept doubles in ToNumber calls.
-var object = { valueOf() { return 42.195; } };
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(object), true);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstonumberobjectwithoutexecutionjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/to-number-object-without-execution.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/to-number-object-without-execution.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/to-number-object-without-execution.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,20 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error(`bad value: ${String(actual)}`);
-}
-
-function test(x, y)
-{
-    if (x)
-        return Number(y);
-    return y;
-}
-noInline(test);
-
-var object = { valueOf() { return 41; } };
-// Since Number is handled by inlining, it emits ForceOSRExit.
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(false, object), object);
-
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(true, object), 41);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstonumberobjectjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/to-number-object.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/to-number-object.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/to-number-object.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,70 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error(`bad value: ${String(actual)}`);
-}
-
-function test1(object)
-{
-    // The prediction should be Int32.
-    return Number(object);
-}
-noInline(test1);
-
-function test12(object)
-{
-    // Should be Int32 comparison.
-    return Number(object) &lt;= 42;
-}
-noInline(test12);
-
-var object1 = { valueOf() { return 42; } };
-for (var i = 0; i &lt; 1e4; ++i) {
-    shouldBe(test1(object1), 42);
-    shouldBe(test12(object1), true);
-}
-
-function test2(object)
-{
-    // The prediction should be Doubles.
-    return Number(object);
-}
-noInline(test2);
-
-function test22(object)
-{
-    // Should be Double comparison.
-    return Number(object) &lt;= 42;
-}
-noInline(test22);
-
-var object2 = { valueOf() { return 42.195; } };
-for (var i = 0; i &lt; 1e4; ++i) {
-    shouldBe(test2(object2), 42.195);
-    shouldBe(test22(object2), false);
-}
-
-function test3(object)
-{
-    // The prediction should be Int32, and later it should be Doubles.
-    return Number(object);
-}
-noInline(test3);
-
-function test32(object)
-{
-    // Should be Int32 comparison. And later, OSR exit occurs with 42.195. And it should be recompiled as Double comparison.
-    return Number(object) &lt;= 42;
-}
-noInline(test32);
-
-var value = 42;
-var object3 = { valueOf() { return value; } };
-for (var i = 0; i &lt; 1e4; ++i) {
-    shouldBe(test3(object3), value);
-    shouldBe(test32(object3), true);
-}
-value = 42.195;
-for (var i = 0; i &lt; 1e4; ++i) {
-    shouldBe(test3(object3), value);
-    shouldBe(test32(object3), false);
-}
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstonumbervalueprofilingjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/to-number-value-profiling.js (202434 => 202435)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/to-number-value-profiling.js        2016-06-24 18:38:42 UTC (rev 202434)
+++ trunk/Source/JavaScriptCore/tests/stress/to-number-value-profiling.js        2016-06-24 18:51:07 UTC (rev 202435)
</span><span class="lines">@@ -1,19 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error(`bad value: ${String(actual)}`);
-}
-
-function test(x) {
-    return Number(x) &lt; 42;
-}
-noInline(test);
-
-var object = { valueOf() { return 42; } };
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(object), false);
-
-// Leave ToNumber for objects.
-// And this should update the value profiling to accept doubles in ToNumber calls.
-var object = { valueOf() { return 42.195; } };
-for (var i = 0; i &lt; 1e4; ++i)
-    shouldBe(test(object), false);
</del></span></pre>
</div>
</div>

</body>
</html>